Since your post was a reply to a very old thread I moved it into its own thread for greater visibility (old thread for reference - https://community.splunk.com/t5/Getting-Data-In/What-happens-when-the-forwarder-is-configured-to-send-data-to-a/m-p/312596#M58584 ) And to your question - the error is a result of a search running mcollect command. By host naming I suppose you have distributed architecture. Are you sure you have properly configured data routing? Your events generated on SHs should be properly routed to indexers. Otherwise you might get into situation like this - you have the indexes on your indexers but the events are generated using collect or mcollect on SHs and since they are not forwarded to indexers, your SHs are trying to index them locally where they might not have destination indexes and not have last chance indexes configured. ... View more

Hi,  Thanks  ... View more

Hi  Your case should end with ,1=1, 100) and not 1==1,100 ... View more

OR run <splunkweb>/en-US/debug/refresh ... View more

Thank you for your reply  ... View more

Used this to find the HF's  | set diff [search earliest="-30m" index=_internal host="*-splunk-hf" | dedup host | table host] [search earliest="-10m" index=_internal host="*-splunk-hf" | dedup host | table host] ... View more