The sample_app was a demo app shipped with splunk.
It was shipped with some sample logs, and the configuration to create the sample index.
This app is usually disabled by default. (But was enabled on old versions of splunk 4.0 or 4.1)
It seems that in your case, the app is disabled on the indexer, but is enabled on at least one of your forwarders. Therefore it is sending some sample logs to an index that doesn't exists on the indexer, and causes the Error message.
Please login to the host mentioned on the error message, and disable the sample app :
from the Web Interface
or the command line: splunk disable app sample_app
or by editing the configuration and restarting to apply
in $SPLUNK_HOME/etc/apps/sample_app/local/app.conf add
[install]
state = disabled
... View more