Search peer XXXBIXX has the following message: Received event for unconfigured/disabled/deleted index

[90522prakash]

Hi,

Below warning message is showing in our Search head cluster.

Search peer XXXBIXX has the following message: Received event for unconfigured/disabled/deleted
index=A with source="B" host="host::C" sourcetype="D". So far received events from 2 missing index(es).

I have verified "A" Index is not exists in our indexers and from the host no internal logs received except license_usage.log.

how to figured out where the inputs configured for this host host="host::C" ?

[gcusello]

Hi @90522prakash,

the message you have means that in your inputs.conf on those hosts there's an input stanza in inputs.conf that is configured to send logs to Index="A".

You can check running from CLI on those forwarders the btool command

/opt/splunk/bin/splunk cmd btool inputs list --debug | grep "index"

so check if there's an index=A.

Ciao.

Giuseppe