Splunk Search

WARN : Eventtype 'xxxxxxxx' does not exist or is disabled. Errors coming from indexers

pbrinkman
Path Finder

hi all,

I have had a number of scheduled searches that failed, all returning the same errors.

WARN : Eventtype 'xxxxxxxx' does not exist or is disabled.
WARN : [INDEXER 1] Eventtype 'xxxxxxxx' does not exist or is disabled.
WARN : [INDEXER 2] Eventtype 'xxxxxxxx' does not exist or is disabled.
WARN : [INDEXER 3] Eventtype 'xxxxxxxx' does not exist or is disabled.
WARN : [INDEXER 4] Eventtype 'xxxxxxxx' does not exist or is disabled.

Could someone explain why the indexers were returning the errors when all eventtypes are located on the search heads ?

cheers
Paul

Tags (1)
0 Karma

FrankVl
Ultra Champion

Search heads push a bundle of knowledge objects to the indexers, to enable the indexers to perform searches.

These errors are typically caused by a tag (in tags.conf) that refers to an eventtype that is not defined / disabled / in another app and not shared / not readable by current user.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...