It does show the index as enabled on the indexers. I found these logs in the search head splunkd.log: 05-26-2022 12:54:26.980 +0000 WARN DateParserVerbose [30526 merging] - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Thu May 26 12:54:24 2022). Context: source=/opt/apps/splunk/var/log/splunk/jmx.log|host=[removed]|jmx-too_small|144797 05-20-2022 16:34:20.408 +0000 INFO SpecFiles - Found external scheme definition for stanza="ibm_was_jmx://" from spec file="/opt/apps/splunk/etc/apps/Splunk_TA_jmx/README/inputs.conf.spec" with parameters="config_file, config_file_dir" 05-23-2022 21:52:22.077 +0000 WARN IndexerService [30474 indexerPipe] - Received event for unconfigured/disabled/deleted index=jmx with source="source::com.sun.messaging.jms.server:type=Connection,subtype=Config,id=2333287862699082496" host="host::[removed]:0" sourcetype="sourcetype::jmx". So far received events from 1 missing index(es).
... View more
