https://community.splunk.com/t5/Deployment-Architecture/I-edited-Disable-1-in-inputs-conf-on-deploymentserver-and/m-p/318682#M19882 <P>Hi,<BR /> You need to make <CODE>disabled=1</CODE> and not disable</P> <PRE><CODE>disabled = [0|1] * Whether or not the event collector input is active. * Set this setting to 1 to disable the input, and 0 to enable it. * Defaults to 1 (disabled). </CODE></PRE> Thu, 18 Jan 2018 01:19:12 GMT 493669 2018-01-18T01:19:12Z https://community.splunk.com/t5/Deployment-Architecture/I-edited-Disable-1-in-inputs-conf-on-deploymentserver-and/m-p/318681#M19881 <P>I edited Disable =1 in inputs.conf on deploymentserver and reloaded but i see that the sourcetypes are still generating events?? please help</P> Wed, 17 Jan 2018 23:34:08 GMT https://community.splunk.com/t5/Deployment-Architecture/I-edited-Disable-1-in-inputs-conf-on-deploymentserver-and/m-p/318681#M19881 sridhar2901 2018-01-17T23:34:08Z https://community.splunk.com/t5/Deployment-Architecture/I-edited-Disable-1-in-inputs-conf-on-deploymentserver-and/m-p/318682#M19882 <P>Hi,<BR /> You need to make <CODE>disabled=1</CODE> and not disable</P> <PRE><CODE>disabled = [0|1] * Whether or not the event collector input is active. * Set this setting to 1 to disable the input, and 0 to enable it. * Defaults to 1 (disabled). </CODE></PRE> Thu, 18 Jan 2018 01:19:12 GMT https://community.splunk.com/t5/Deployment-Architecture/I-edited-Disable-1-in-inputs-conf-on-deploymentserver-and/m-p/318682#M19882 493669 2018-01-18T01:19:12Z https://community.splunk.com/t5/Deployment-Architecture/I-edited-Disable-1-in-inputs-conf-on-deploymentserver-and/m-p/318683#M19883 <P>And don't forget to check what "stateOnClient" is set to in your serverclass.conf. By default that is set to enabled, which means that the inputs.conf will get pushed to your forwarders in enabled state regardless of the state you set in inputs.conf on the DS.</P> <PRE><CODE>stateOnClient = enabled | disabled | noop * If set to "enabled", sets the application state to enabled on the client, regardless of state on the deployment server. * If set to "disabled", set the application state to disabled on the client, regardless of state on the deployment server. * If set to "noop", the state on the client will be the same as on the deployment server. * Can be overridden at the serverClass level and the serverClass:app level. * Defaults to enabled. </CODE></PRE> Thu, 18 Jan 2018 07:58:59 GMT https://community.splunk.com/t5/Deployment-Architecture/I-edited-Disable-1-in-inputs-conf-on-deploymentserver-and/m-p/318683#M19883 FrankVl 2018-01-18T07:58:59Z https://community.splunk.com/t5/Deployment-Architecture/I-edited-Disable-1-in-inputs-conf-on-deploymentserver-and/m-p/318684#M19884 <P>My Universal forwarders received the changes but they are not restarting to reflect the change. I had to manually restart all of my 16 forwarders.....Why is is happening??</P> Fri, 19 Jan 2018 17:21:08 GMT https://community.splunk.com/t5/Deployment-Architecture/I-edited-Disable-1-in-inputs-conf-on-deploymentserver-and/m-p/318684#M19884 sridhar2901 2018-01-19T17:21:08Z https://community.splunk.com/t5/Deployment-Architecture/I-edited-Disable-1-in-inputs-conf-on-deploymentserver-and/m-p/318685#M19885 <P>What does your serverclass.conf look like?</P> Sat, 20 Jan 2018 18:16:53 GMT https://community.splunk.com/t5/Deployment-Architecture/I-edited-Disable-1-in-inputs-conf-on-deploymentserver-and/m-p/318685#M19885 FrankVl 2018-01-20T18:16:53Z