You have two different issues here.
1) An unknown UF is sending information, which your indexers are attempting to index.
2) Your indexers are determining that that data should be in an index that does not exist.
Each of these is a configuration issue.
In order for your indexer to be determining that the events should be placed in a nonexistent index, there generally must be a configuration ON THAT INDEXER that sends them there. Find that configuration and fix it.
If there is no configuration on the indexer that sends data to that index, then you have a heavy forwarder half-cooking the data and sending to the indexers. If there are heavy forwarders in your overall system configuration, that is the place to look for the issue.
Finally, if that UF is completely rogue and the data is not useful, then you can just route all data from that UF to the null queue.
Just create a stanza for that UF/host as per this doc:
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues
... View more