Installation

Error after migration to 4.1.2: Received event for unconfigured/disabled index ...

Voltaire
Communicator

I have received a few errors from my Light Forwarders on my main Splunk indexer.

"received event for unconfigured/disabled index='$splunk_db/qdb/db' with source='source::WMI:RAS Total' host='host::qdbdbt1 ' sourcetype='sourcetype::WMI:RAS Total'"

I also upgraded the lightforwarder to 4.1.2 in hopes of correcting the problem.

Any assistance is greatly appreciated.

Thanks V

Tags (1)
0 Karma

the_wolverine
Champion

This error is new as of version 4.1.2. The error means that you have data coming in for which no index has been configured or enabled. Previously, Splunk did not provide a warning message (in UI) for situations where events are dropped due to non-existent or disabled index.

You should check your LWF configuration for any inputs that might be sending to this index.

Does such an index exist at your indexer? If yes, is the index enabled?

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...