- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How can we clean messages about unconfigured/disab...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have some messages saying -
Search peer <host> has the following message: Received event for unconfigured/disabled/deleted index=<index_name> with source="<source_name>" host="<host_name>" sourcetype="<sourcetype_name>". So far received events from 6 missing index(es).
Since this index - <index_name> doesn't exist, I wonder if I should delete these events at parse time based on the index name. Is it possible?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want to eliminate those events, then route them to the nullqueue instead of the non-existent index.
https://answers.splunk.com/answers/59370/filtering-events-using-nullqueue.html
You COULD put a stanza for that index, but it would be better to take the stanza that is currently routing event to that index and route them instead to the null queue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want to eliminate those events, then route them to the nullqueue instead of the non-existent index.
https://answers.splunk.com/answers/59370/filtering-events-using-nullqueue.html
You COULD put a stanza for that index, but it would be better to take the stanza that is currently routing event to that index and route them instead to the null queue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you @DalJeanis - gorgeous as usual.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ddrillic - I'm honored.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The best way to clean up those messages is fix the cause of them. Create the missing index (or enable it if it's disabled). By ignoring this message you risk losing data if you don't have a default index configured.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you @richgalloway. In this case, the events are not needed. Is there a way to eliminate them at parsing time?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the events are coming from the same input, deleting that input.conf stanza will stop them from coming in.
You can use btool to find the inputs.conf file to edit. splunk btool --debug inputs list | grep <index_name>.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Right, right, to some forwarders we don't have access at all and their inputs.conf is not always being administered by the central deployment server...
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
