topic Re: How do I delete a duplicate data input in Getting Data In

How do I delete a duplicate data input

udiggity — Wed, 16 Mar 2011 18:43:36 GMT

Somehow I have a duplicate remote directory input listed in my inputs it is in the format ///servername//direcotory// I also have it listed with the proper UNC path like \servername\director\ Both seem to be collecting. When I try to remove the first one I get the error Error occurred attempting to disable \\ncmec-radius\service\: In handler 'monitor': Object disabling requires user and application to be specified.

Any idea how I remove this?

Re: How do I delete a duplicate data input

netwrkr — Wed, 16 Mar 2011 20:58:10 GMT

I'm not a Windows guy but...assuming Splunk *nix operates in the same way. Go to where the 'inputs.conf' file is - typically $SPLUNK_HOME/etc/apps/search/local/ and remove the duplicate directory entry. I would recommend first stopping splunk, editing the file, and then restarting.

Re: How do I delete a duplicate data input

udiggity — Wed, 16 Mar 2011 21:03:36 GMT

Thanks I will try this now.

Re: How do I delete a duplicate data input

udiggity — Wed, 16 Mar 2011 21:08:56 GMT

Thanks, that did it!

Re: How do I delete a duplicate data input

netwrkr — Wed, 16 Mar 2011 21:44:38 GMT

Marking my answer as helpful is always appreciated 🙂