Installation

Error after migration to 4.1.2: Received event for unconfigured/disabled index ...

Voltaire
Communicator

I have received a few errors from my Light Forwarders on my main Splunk indexer.

"received event for unconfigured/disabled index='$splunk_db/qdb/db' with source='source::WMI:RAS Total' host='host::qdbdbt1 ' sourcetype='sourcetype::WMI:RAS Total'"

I also upgraded the lightforwarder to 4.1.2 in hopes of correcting the problem.

Any assistance is greatly appreciated.

Thanks V

Tags (1)
0 Karma

the_wolverine
Champion

This error is new as of version 4.1.2. The error means that you have data coming in for which no index has been configured or enabled. Previously, Splunk did not provide a warning message (in UI) for situations where events are dropped due to non-existent or disabled index.

You should check your LWF configuration for any inputs that might be sending to this index.

Does such an index exist at your indexer? If yes, is the index enabled?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...