Monitoring Splunk

index=_internal is disabled and i am not sure how to get it back on?

robertlynch2020
Motivator

Hi

I came in today and about 5 indexes are disabled.

I am getting the following messages, but i am unsure what to do? 

robertlynch2020_0-1592509899636.png

Even after restarting i am getting the message it is disabled.

06-18-2020 21:34:47.998 +0200 INFO IndexProcessor - indexes.conf - Rawdata integrity control (enableDataIntegrityControl) is disabled for index=_internal

 

06-18-2020 21:34:47.997 +0200 INFO  IndexWriter - idx=_internal Handling shutdown or signal, reason=2
06-18-2020 21:34:47.998 +0200 INFO  IndexProcessor - Reloading index config: shutdown subordinate threads, now restarting
06-18-2020 21:34:47.998 +0200 INFO  IndexProcessor - indexes.conf - Rawdata integrity control (enableDataIntegrityControl) is disabled for index=_internal
06-18-2020 21:34:47.998 +0200 INFO  HotDBManager - idx=_internal minHotIdleSecsBeforeForceRoll=4294967295
06-18-2020 21:34:47.998 +0200 INFO  HotDBManager - idx=_internal Setting hot mgr params: maxHotSpanSecs=432000 maxHotBuckets=20 minHotIdleSecsBeforeForceRoll=4294967295 maxDataSizeBytes=1048576000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000 
06-18-2020 21:34:47.998 +0200 INFO  HotDBManager - closing hot mgr for idx=_internal
06-18-2020 21:34:47.998 +0200 INFO  IndexWriter - idx=_internal, Initializing, 

 

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It certainly looks like someone else changed your configuration while you were away.  Indexes don't just disable themselves and restarting Splunk won't re-enable them. 

What instance type (SH, indexer, etc.) is the screenshot from?

To enable an index you must click on "Enable" in the GUI or edit the indexes.conf file(s) to set "disabled = 0" for the indexes.

Check your indexes.conf file(s) (use btool) to make sure enableDataIntegrityControl is not set for the internal indexes.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It certainly looks like someone else changed your configuration while you were away.  Indexes don't just disable themselves and restarting Splunk won't re-enable them. 

What instance type (SH, indexer, etc.) is the screenshot from?

To enable an index you must click on "Enable" in the GUI or edit the indexes.conf file(s) to set "disabled = 0" for the indexes.

Check your indexes.conf file(s) (use btool) to make sure enableDataIntegrityControl is not set for the internal indexes.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

robertlynch2020
Motivator

Hi

Thanks for your replay, it looks like we were having issues with rights on this one, we had to enable "All internal indexes".

We are looking into how this happened, so thanks for your replay.

 

Rob

Tags (1)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!