Why am I getting error "Search peer XXX has the following message: received event for unconfigured/disabled/deleted index='YYY'..."?

[IRHM73]

Hi, I wonder if someone may be able to help me please.

I'm starting to learn more about the administration aspect of Splunk so I'm looking deeper into the various warning messages which I recieve.

I'm receiving the following message, but despite Googling this I haven't been able to discover it's true meaning.

Error: Search peer qa-splunk-indexer-1
has the following message: received
event for
unconfigured/disabled/deleted
index='test_session_summary' with
source='source::mdtp_citizen_auth_fe_endpoint_change_autotest'
host='host::qa-splunk-search'
sourcetype='sourcetype::stash' (1
missing total)

I'm aware that this line index='test_session_summary' is the name of my index, but at a loss as to what the rest means.

I just wonder whether someone may be able to shed some light on this for me please.

Many thanks and kind regards

Chris

[esix_splunk · Accepted solution]

Error: Search peer qa-splunk-indexer-1 has the following message: received event for unconfigured/disabled/deleted index='test_session_summary' with source='source::mdtp_citizen_auth_fe_endpoint_change_autotest' host='host::qa-splunk-search' sourcetype='sourcetype::stash' (1 missing total)

This is telling you that the host 'qa-splunk-indexer-1' is reporting back that there is no index named 'test_session_summary' on that host. Or it can mean that the index is created, but disabled.

Source is mdtp_citizen_auth_fe_endpoint_change_autotest, which I dont recognize but is one of your data sources.

Sourcetype is is the sourcetype associated to this error message, in this case: "stash". Stash is the sourcetype set for summary indexing.

Based on this, I would say you have a saved search that you are running and have selected it to create summary data and specified the 'test_session_summary' index as the destination.

However, you haven't created this on your indexer...

[IRHM73]

Hi @esix, thank you very much for taking the time to come back to me with this and for the explanation.

Kind Regards

Chris