Splunk Search

Why am I getting error "Search peer XXX has the following message: received event for unconfigured/disabled/deleted index='YYY'..."?

IRHM73
Motivator

Hi, I wonder if someone may be able to help me please.

I'm starting to learn more about the administration aspect of Splunk so I'm looking deeper into the various warning messages which I recieve.

I'm receiving the following message, but despite Googling this I haven't been able to discover it's true meaning.

Error: Search peer qa-splunk-indexer-1
has the following message: received
event for
unconfigured/disabled/deleted
index='test_session_summary' with
source='source::mdtp_citizen_auth_fe_endpoint_change_autotest'
host='host::qa-splunk-search'
sourcetype='sourcetype::stash' (1
missing total)

I'm aware that this line index='test_session_summary' is the name of my index, but at a loss as to what the rest means.

I just wonder whether someone may be able to shed some light on this for me please.

Many thanks and kind regards

Chris

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

Error: Search peer qa-splunk-indexer-1 has the following message: received event for unconfigured/disabled/deleted index='test_session_summary' with source='source::mdtp_citizen_auth_fe_endpoint_change_autotest' host='host::qa-splunk-search' sourcetype='sourcetype::stash' (1 missing total)

This is telling you that the host 'qa-splunk-indexer-1' is reporting back that there is no index named 'test_session_summary' on that host. Or it can mean that the index is created, but disabled.

Source is mdtp_citizen_auth_fe_endpoint_change_autotest, which I dont recognize but is one of your data sources.

Sourcetype is is the sourcetype associated to this error message, in this case: "stash". Stash is the sourcetype set for summary indexing.

Based on this, I would say you have a saved search that you are running and have selected it to create summary data and specified the 'test_session_summary' index as the destination.

However, you haven't created this on your indexer...

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

Error: Search peer qa-splunk-indexer-1 has the following message: received event for unconfigured/disabled/deleted index='test_session_summary' with source='source::mdtp_citizen_auth_fe_endpoint_change_autotest' host='host::qa-splunk-search' sourcetype='sourcetype::stash' (1 missing total)

This is telling you that the host 'qa-splunk-indexer-1' is reporting back that there is no index named 'test_session_summary' on that host. Or it can mean that the index is created, but disabled.

Source is mdtp_citizen_auth_fe_endpoint_change_autotest, which I dont recognize but is one of your data sources.

Sourcetype is is the sourcetype associated to this error message, in this case: "stash". Stash is the sourcetype set for summary indexing.

Based on this, I would say you have a saved search that you are running and have selected it to create summary data and specified the 'test_session_summary' index as the destination.

However, you haven't created this on your indexer...

IRHM73
Motivator

Hi @esix, thank you very much for taking the time to come back to me with this and for the explanation.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...