topic Re: Error occurred during trying to delete an Data TCP Input in Getting Data In

Error occurred during trying to delete an Data TCP Input

AchimK — Mon, 05 Feb 2024 10:58:21 GMT

I have the problem that I can't delete an input filter that I probably formulated incorrectly so that I can take it out.

Error occurred attempting to remove a.b.*.*, c.d.e.0, f.g.*:5514: Malformed IP address: a.b.*.*, c.d.e.0, f.g.*:5514.

An outputs.conf under /system/local does not exist

Re: Error occurred during trying to delete an Data TCP Input

scelikok — Mon, 05 Feb 2024 12:15:44 GMT

Hi @AchimK,

You should check input settings inside inputs.conf file. If you created this input using GUI it may be under search app. You can find the place using btool like below.

splunk btool inputs list tcp --debug | grep 5514

This will show the path of inputs.conf file that you should edit to delete malformed TCP input.

Re: Error occurred during trying to delete an Data TCP Input

AchimK — Mon, 05 Feb 2024 16:58:37 GMT

Hi scelikok,

I killed the IP's restart splunk, but the data input with port 5514 is not deletable

Error occurred attempting to remove :5514: Malformed IP address: :5514.

here the inputs file

[splunktcp://9997] connection_host = ip [tcp://:5514] connection_host = ip host = splunkindex index = linux sourcetype = linux_messages_syslog disabled = 1

Re: Error occurred during trying to delete an Data TCP Input

scelikok — Mon, 05 Feb 2024 18:26:15 GMT

Hi @AchimK,

You should delete colon before the port number like below. Or why don't you just delete this stanza from inputs.conf ?

[tcp://5514] connection_host = ip host = splunkindex index = linux sourcetype = linux_messages_syslog disabled = 1

Re: Error occurred during trying to delete an Data TCP Input

AchimK — Fri, 09 Feb 2024 06:55:13 GMT

Hi @scelikok

it works, sorry for the delay. Today I checked it.

Best regards

AchimK