Splunk Enterprise

Kept receiving error message at indexer

Nicholas_Key
Splunk Employee
Splunk Employee

Hi all,

I'm trying to forward my summarized events from an indexer (machine1) to multiple indexers (machine2 and machine 3) and I'm seeing this error message at machine2 and machine3:

received event for unconfigured/disabled index='summary_forwarders' with source='source::All forwarders - regenerator summary index' host='host::machine1' sourcetype='sourcetype::stash'

I'm really sure that I'm not using summary_forwarders in any way.

Any idea why this happens?

Tags (1)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You have a summary index search configured on machine1 that puts data into the index summary_forwarders that doesn't exist on machine2 or machine3. This is probably from the beta SplunkDeploymentMonitor app. Is it installed only on machine1?

Get Updates on the Splunk Community!

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...