topic How to delete modular input? in Splunk Enterprise

How to delete modular input?

sacumen — Mon, 30 Jan 2023 15:41:44 GMT

Hello Everyone,

I am trying to delete my modular input and the input inside configuration tab -->Account, trying to add new account but not able to delete that getting error message like "Object id=xxx://Test cannot be deleted in config=inputs in splunk ".

Can anyone please let me know ho to delete that?

Thank You.

Re: Unable to delete modular input

richgalloway — Fri, 30 Oct 2020 12:54:34 GMT

Make sure the relevant inputs.conf file is not open by a non-Splunk process, like an editor. Also, verify no one else deleted or moved the MI.

Re: Unable to delete modular input

sacumen — Fri, 30 Oct 2020 13:02:01 GMT

Thanks for response @richgalloway . No files are open there and I am only testing this on my machine.

Re: Unable to delete modular input

richgalloway — Fri, 30 Oct 2020 13:50:34 GMT

Check splunkd.log for other messages that may have identify the cause.
An alternative method is to edit inputs.conf directly and restart Splunk.

Re: Unable to delete modular input

sloshburch — Sat, 28 Jan 2023 02:31:20 GMT

Hiya - I just ran into this in another app and I think I found root cause. It seemed like a permission thing so on a hunch I peeked at the local.meta and default.meta. The default.meta for the app had a bunch of stuff in there from the app being built. I removed all of it except the default and view stanzas, restarted, and then I was able to delete the input no problem. So I'm guessing there was some default.meta stanza made by a user not in my system that blocked my ability from deleting.

If you got the app from Splunkbase then let the author know so they can clean out that default.meta.