Splunk Search

Why am I getting error "Search peer XXX has the following message: received event for unconfigured/disabled/deleted index='YYY'..."?

IRHM73
Motivator

Hi, I wonder if someone may be able to help me please.

I'm starting to learn more about the administration aspect of Splunk so I'm looking deeper into the various warning messages which I recieve.

I'm receiving the following message, but despite Googling this I haven't been able to discover it's true meaning.

Error: Search peer qa-splunk-indexer-1
has the following message: received
event for
unconfigured/disabled/deleted
index='test_session_summary' with
source='source::mdtp_citizen_auth_fe_endpoint_change_autotest'
host='host::qa-splunk-search'
sourcetype='sourcetype::stash' (1
missing total)

I'm aware that this line index='test_session_summary' is the name of my index, but at a loss as to what the rest means.

I just wonder whether someone may be able to shed some light on this for me please.

Many thanks and kind regards

Chris

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

Error: Search peer qa-splunk-indexer-1 has the following message: received event for unconfigured/disabled/deleted index='test_session_summary' with source='source::mdtp_citizen_auth_fe_endpoint_change_autotest' host='host::qa-splunk-search' sourcetype='sourcetype::stash' (1 missing total)

This is telling you that the host 'qa-splunk-indexer-1' is reporting back that there is no index named 'test_session_summary' on that host. Or it can mean that the index is created, but disabled.

Source is mdtp_citizen_auth_fe_endpoint_change_autotest, which I dont recognize but is one of your data sources.

Sourcetype is is the sourcetype associated to this error message, in this case: "stash". Stash is the sourcetype set for summary indexing.

Based on this, I would say you have a saved search that you are running and have selected it to create summary data and specified the 'test_session_summary' index as the destination.

However, you haven't created this on your indexer...

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

Error: Search peer qa-splunk-indexer-1 has the following message: received event for unconfigured/disabled/deleted index='test_session_summary' with source='source::mdtp_citizen_auth_fe_endpoint_change_autotest' host='host::qa-splunk-search' sourcetype='sourcetype::stash' (1 missing total)

This is telling you that the host 'qa-splunk-indexer-1' is reporting back that there is no index named 'test_session_summary' on that host. Or it can mean that the index is created, but disabled.

Source is mdtp_citizen_auth_fe_endpoint_change_autotest, which I dont recognize but is one of your data sources.

Sourcetype is is the sourcetype associated to this error message, in this case: "stash". Stash is the sourcetype set for summary indexing.

Based on this, I would say you have a saved search that you are running and have selected it to create summary data and specified the 'test_session_summary' index as the destination.

However, you haven't created this on your indexer...

IRHM73
Motivator

Hi @esix, thank you very much for taking the time to come back to me with this and for the explanation.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...