Getting Data In

moving index to one server

gudavasr
Path Finder

I have indexes on two servers and moved index to one server:
I followed the followind guidelines:
http://splunk-base.splunk.com/answers/10184/consolidate-databases-from-multiple-splunk-instances
and
http://splunk-base.splunk.com/answers/34811/how-can-i-find-all-duplicate-bucket-ids-that-are-causing...

but I still get this error:
IndexProcessor - received eve
IndexProcessor - received event for unconfigured/disabled index='_audit' with source='source::audittrail' host='host::wspra99a0546' sourcetype='sourcetype::audittrail' (1 missing total)

nt for unconfigured/disabled index='_internal' with source='source::/opt/local/qosmont/splunk_search_head_02_sit/var/log/splunk/splunkd.log' host='host::wspra99a0546' sourcetype='sourcetype::splunkd' (2 missing total)

How can I fix these?

Thank You.

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi gudavasr

check if those indexes are disabled:

| rest /services/data/indexes | table title disabled

if so you can enable them in 'Manager >> Indexes'
probably it is also possible via REST but I haven't checked on that yet 😉

cheers,
MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi gudavasr

check if those indexes are disabled:

| rest /services/data/indexes | table title disabled

if so you can enable them in 'Manager >> Indexes'
probably it is also possible via REST but I haven't checked on that yet 😉

cheers,
MuS

gudavasr
Path Finder

This worked. Can you explain why indexes automatically got enabled when it is restarted?
Thank You

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...