All Apps and Add-ons

SCCM App for Splunk: Why is a search peer showing "received event for unconfigured/disabled/deleted index='sccm'..."

barunbiswas
New Member

I am receiving the this message after installing the SCCM App for Splunk:

Search peer host2 has the following message: received event for unconfigured/disabled/deleted index='sccm' with source='source::dbmon-tail://sccm/sccm_agent_discoveries_dbinput' host='host::sccm' sourcetype='sourcetype::sccm:discovery'

The inputs.conf under dbx has been appended with below stanzas.

....
host = sccm
index = sccm
...
...

Splunk is running on host1, indexer is running on host2, and sccm is running on host3. I can see the sccm index from GUI.

Could you advise me on this please?

0 Karma

maciep
Champion

It sounds like you need the index to be on host2. when you say you see it in the gui, do you mean you see it on host2 in the gui? If you run the following from the cli on host2 (your indexer), what do you get?

splunk btool indexes list sccm --debug | grep -v system/default
0 Karma

barunbiswas
New Member

Thanks for the reply.
Execution of the above command on host2 gives below output:

/opt/splunk/etc/system/local/indexes.conf [sccm]
/opt/splunk/etc/system/local/indexes.conf coldPath = $SPLUNK_DB/sccm/colddb
/opt/splunk/etc/system/local/indexes.conf homePath = $SPLUNK_DB/sccm/db
/opt/splunk/etc/system/local/indexes.conf thawedPath = $SPLUNK_DB/sccm/thaweddb
/opt/splunk/etc/system/local/indexes.conf [sccm_status]
/opt/splunk/etc/system/local/indexes.conf coldPath = $SPLUNK_DB/sccm_status/colddb
/opt/splunk/etc/system/local/indexes.conf homePath = $SPLUNK_DB/sccm_status/db
/opt/splunk/etc/system/local/indexes.conf thawedPath = $SPLUNK_DB/sccm_status/thaweddb

Please advise what should I do.

0 Karma

maciep
Champion

Sorry, I don't think I get alerted/emails on these comments so I tend to miss them (I'll check my settings).

Anyway, that looks good to me. Did you restart splunk on the indexer since installing the SCCM app?

0 Karma

barunbiswas
New Member

Np. Many thanks for the reply.

What I did is:
i) I reloaded indexex on the indexer server using command: ./splunk reload index
ii) restarted Splunk from GUI (Settings-> Server Control)

As I am new to Splunk, could you please advise me what should I do next.

0 Karma

maciep
Champion

So you're still getting that message?

I'm not sure, honestly. Typically that message means that the index doesn't exist on your indexer. Maybe there is something wrong with index configuration though?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...