index=_internal is disabled and i am not sure how to get it back on?

[robertlynch2020]

Hi

I came in today and about 5 indexes are disabled.

I am getting the following messages, but i am unsure what to do? 

Even after restarting i am getting the message it is disabled.

06-18-2020 21:34:47.998 +0200 INFO IndexProcessor - indexes.conf - Rawdata integrity control (enableDataIntegrityControl) is disabled for index=_internal

06-18-2020 21:34:47.997 +0200 INFO  IndexWriter - idx=_internal Handling shutdown or signal, reason=2
06-18-2020 21:34:47.998 +0200 INFO  IndexProcessor - Reloading index config: shutdown subordinate threads, now restarting
06-18-2020 21:34:47.998 +0200 INFO  IndexProcessor - indexes.conf - Rawdata integrity control (enableDataIntegrityControl) is disabled for index=_internal
06-18-2020 21:34:47.998 +0200 INFO  HotDBManager - idx=_internal minHotIdleSecsBeforeForceRoll=4294967295
06-18-2020 21:34:47.998 +0200 INFO  HotDBManager - idx=_internal Setting hot mgr params: maxHotSpanSecs=432000 maxHotBuckets=20 minHotIdleSecsBeforeForceRoll=4294967295 maxDataSizeBytes=1048576000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000 
06-18-2020 21:34:47.998 +0200 INFO  HotDBManager - closing hot mgr for idx=_internal
06-18-2020 21:34:47.998 +0200 INFO  IndexWriter - idx=_internal, Initializing, 

[richgalloway · Accepted solution]

It certainly looks like someone else changed your configuration while you were away.  Indexes don't just disable themselves and restarting Splunk won't re-enable them. 

What instance type (SH, indexer, etc.) is the screenshot from?

To enable an index you must click on "Enable" in the GUI or edit the indexes.conf file(s) to set "disabled = 0" for the indexes.

Check your indexes.conf file(s) (use btool) to make sure enableDataIntegrityControl is not set for the internal indexes.

[robertlynch2020]

Hi

Thanks for your replay, it looks like we were having issues with rights on this one, we had to enable "All internal indexes".

We are looking into how this happened, so thanks for your replay.

Rob