We recently upgraded to 4.2.2. Since the upgrade - we've been receiving yellow warning messages at the top of the Splunk Web screen (text changed): Search peer "indexer1" has the following message: received event for unconfigured/disabled index='foo' with source='source::C:\foo.log' host='host::foo' sourcetype='sourcetype::foo-too_small' (1 missing total) We noticed that the index name was spelled incorrectly, and have since fixed the problem. Now, 24 hours later, we can't get the error/warn message to go away on our 3 search heads. We've restarted the search heads multiple times and no luck, it's still there. Can anyone provide any information on how to get rid of this? Thanks! ... View more