https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84330#M17518 <P>where this path will be please?<BR /> I can't find it in universal forwarder(windows) or in indexer</P> <P>the only local folder is /etc/system/local and /etc/apps/MSICreated/local</P> Fri, 29 Jun 2012 14:07:31 GMT splunker_123 2012-06-29T14:07:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84321#M17509 <P>Hi</P> <P>I've installed the splunk indexer on linux machine and universal forwader on a windows machine.While installing universal forwader - at the Installation wizard I gave some basic inputs to enable like CPU load,disk space and system log in windows but I dont want to monitor this any more so I need to remove this info.I have cleared the inputs.conf under $SPLUNKHOME/etc/apps/MSICreated/inputs.conf and $SPLUNKHOME/etc/system/local/inputs.conf but still the inputs ' CPU load,disk space and system log' is shown in splunk web console</P> <P>How do I remove the above inputs from indexing please?</P> <P>Thanks</P> Tue, 26 Jun 2012 15:48:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84321#M17509 splunker_123 2012-06-26T15:48:58Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84322#M17510 <P>run:<BR /> splunk cmd btool inputs list --debug</P> <P>This will give you all of the configured inputs, and their properties. the first column will indicate which app has configured that input.</P> <P>Is the data you're seeing possibly from before the inputs were removed? Did you restart after modifying the inputs?</P> Tue, 26 Jun 2012 15:52:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84322#M17510 mikelanghorst 2012-06-26T15:52:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84323#M17511 <P>I executed the above command and in the outputs listed I can't see the 'CPU load,disk space and system log'.the first column displays only one app - system.<BR /> yes I restarted twice after removing the inputs.conf</P> <P>any other suggestions please?</P> Tue, 26 Jun 2012 16:34:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84323#M17511 splunker_123 2012-06-26T16:34:01Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84324#M17512 <P>anyone know this please?</P> Wed, 27 Jun 2012 15:49:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84324#M17512 splunker_123 2012-06-27T15:49:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84325#M17513 <P>Would need to see you're etc/system/local/inputs.conf if it's not configured in there, then there's no reason why it should be still getting data if you've restarted. Can you confirm that new data is still being indexed, not just seeing old data?</P> Wed, 27 Jun 2012 15:53:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84325#M17513 mikelanghorst 2012-06-27T15:53:42Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84326#M17514 <P>This should be simple to fix, if you're interested and could join #splunk on EFNet we could knock this out pretty easy. <A href="http://cbe002.chat.mibbit.com/">http://cbe002.chat.mibbit.com/</A> is one webclient</P> Wed, 27 Jun 2012 15:57:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84326#M17514 mikelanghorst 2012-06-27T15:57:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84327#M17515 <P>there is nothing configured in the etc/system/local/inputs.conf but I can see few entries in etc/system/default/inputs.conf - is it taking input from there?<BR /> I can confirm it is the new data being indexed,not the old one because even after deleting the old data from index I can see the updated data again..</P> Fri, 29 Jun 2012 11:55:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84327#M17515 splunker_123 2012-06-29T11:55:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84328#M17516 <P>Do any one have any clue on this please?</P> Fri, 29 Jun 2012 13:17:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84328#M17516 splunker_123 2012-06-29T13:17:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84329#M17517 <P>etc/system/apps/unix/local</P> Fri, 29 Jun 2012 13:30:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84329#M17517 jfraiberg 2012-06-29T13:30:13Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84330#M17518 <P>where this path will be please?<BR /> I can't find it in universal forwarder(windows) or in indexer</P> <P>the only local folder is /etc/system/local and /etc/apps/MSICreated/local</P> Fri, 29 Jun 2012 14:07:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84330#M17518 splunker_123 2012-06-29T14:07:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84331#M17519 <P>i am sorry, I misread your question. disregard my answer.</P> Fri, 29 Jun 2012 14:34:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-inputs-that-are-given-at-time-of-universal/m-p/84331#M17519 jfraiberg 2012-06-29T14:34:05Z