Hi,
Below warning message is showing in our Search head cluster.
Search peer XXXBIXX has the following message: Received event for unconfigured/disabled/deleted
index=A with source="B" host="host::C" sourcetype="D". So far received events from 2 missing index(es).
I have verified "A" Index is not exists in our indexers and from the host no internal logs received except license_usage.log.
how to figured out where the inputs configured for this host host="host::C" ?
Hi @90522prakash,
the message you have means that in your inputs.conf on those hosts there's an input stanza in inputs.conf that is configured to send logs to Index="A".
You can check running from CLI on those forwarders the btool command
/opt/splunk/bin/splunk cmd btool inputs list --debug | grep "index"
so check if there's an index=A.
Ciao.
Giuseppe