Monitoring Splunk

index=_internal is disabled and i am not sure how to get it back on?

robertlynch2020
Motivator

Hi

I came in today and about 5 indexes are disabled.

I am getting the following messages, but i am unsure what to do? 

robertlynch2020_0-1592509899636.png

Even after restarting i am getting the message it is disabled.

06-18-2020 21:34:47.998 +0200 INFO IndexProcessor - indexes.conf - Rawdata integrity control (enableDataIntegrityControl) is disabled for index=_internal

 

06-18-2020 21:34:47.997 +0200 INFO  IndexWriter - idx=_internal Handling shutdown or signal, reason=2
06-18-2020 21:34:47.998 +0200 INFO  IndexProcessor - Reloading index config: shutdown subordinate threads, now restarting
06-18-2020 21:34:47.998 +0200 INFO  IndexProcessor - indexes.conf - Rawdata integrity control (enableDataIntegrityControl) is disabled for index=_internal
06-18-2020 21:34:47.998 +0200 INFO  HotDBManager - idx=_internal minHotIdleSecsBeforeForceRoll=4294967295
06-18-2020 21:34:47.998 +0200 INFO  HotDBManager - idx=_internal Setting hot mgr params: maxHotSpanSecs=432000 maxHotBuckets=20 minHotIdleSecsBeforeForceRoll=4294967295 maxDataSizeBytes=1048576000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000 
06-18-2020 21:34:47.998 +0200 INFO  HotDBManager - closing hot mgr for idx=_internal
06-18-2020 21:34:47.998 +0200 INFO  IndexWriter - idx=_internal, Initializing, 

 

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It certainly looks like someone else changed your configuration while you were away.  Indexes don't just disable themselves and restarting Splunk won't re-enable them. 

What instance type (SH, indexer, etc.) is the screenshot from?

To enable an index you must click on "Enable" in the GUI or edit the indexes.conf file(s) to set "disabled = 0" for the indexes.

Check your indexes.conf file(s) (use btool) to make sure enableDataIntegrityControl is not set for the internal indexes.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It certainly looks like someone else changed your configuration while you were away.  Indexes don't just disable themselves and restarting Splunk won't re-enable them. 

What instance type (SH, indexer, etc.) is the screenshot from?

To enable an index you must click on "Enable" in the GUI or edit the indexes.conf file(s) to set "disabled = 0" for the indexes.

Check your indexes.conf file(s) (use btool) to make sure enableDataIntegrityControl is not set for the internal indexes.

---
If this reply helps you, Karma would be appreciated.

robertlynch2020
Motivator

Hi

Thanks for your replay, it looks like we were having issues with rights on this one, we had to enable "All internal indexes".

We are looking into how this happened, so thanks for your replay.

 

Rob

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...