https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93284#M19409 <P>It must be located in another inputs.conf. Take a look at those as well.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/admin/Aboutconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/5.0/admin/Aboutconfigurationfiles</A></P> Thu, 01 Nov 2012 13:19:20 GMT sdaniels 2012-11-01T13:19:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93280#M19405 <P>When I had initiall installed my forwarder I selected "security" as one of my inputs. Now I want to remove this as an input but when I type "list monitor" I don't know which input refers to the security one.</P> Wed, 17 Oct 2012 14:20:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93280#M19405 aywong 2012-10-17T14:20:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93281#M19406 <P>I have the same issue, while installing the forwarder i have selected application and system eventlog as input and now i dont need that anymore. What needs to be done to stop sending the eventlog data to indexer?</P> Tue, 30 Oct 2012 15:46:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93281#M19406 anoopambli 2012-10-30T15:46:58Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93282#M19407 <P>Just go to the inputs.conf file on the forwarder and look at the monitor settings. Remove what you don't want from the file and restart Splunk. See the link below.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Data/Editinputs.conf">http://docs.splunk.com/Documentation/Splunk/5.0/Data/Editinputs.conf</A></P> Tue, 30 Oct 2012 15:58:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93282#M19407 sdaniels 2012-10-30T15:58:59Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93283#M19408 <P>I checked inputs.conf file under $SPLUNK_HOME/etc/system/local/ but dont see any reference for Application eventlog. Am i looking at the right inputs.conf file?</P> Wed, 31 Oct 2012 13:48:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93283#M19408 anoopambli 2012-10-31T13:48:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93284#M19409 <P>It must be located in another inputs.conf. Take a look at those as well.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/admin/Aboutconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/5.0/admin/Aboutconfigurationfiles</A></P> Thu, 01 Nov 2012 13:19:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93284#M19409 sdaniels 2012-11-01T13:19:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93285#M19410 <P><CODE>/bin/splunk remove monitor /name/of/previous/monitor</CODE></P> Mon, 25 Apr 2016 18:39:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93285#M19410 scuilion 2016-04-25T18:39:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93286#M19411 <P>By following proper <A href="http://www.walmart.com/">guidelines</A> you can solve your problem.</P> Mon, 25 Apr 2016 19:33:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93286#M19411 Mostafiz07 2016-04-25T19:33:07Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93287#M19412 <P>I downvoted this post because not productive</P> Mon, 25 Apr 2016 21:58:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93287#M19412 scuilion 2016-04-25T21:58:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93288#M19413 <P>I downvoted this post because not helpful</P> Tue, 19 Jul 2016 11:39:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/93288#M19413 gebr 2016-07-19T11:39:07Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/539864#M90410 <P>pretty old topic, but might be useful to someone:</P><P><SPAN>$SPLUNK_HOME</SPAN>/etc/apps/search/local/inputs.conf</P> Mon, 15 Feb 2021 06:06:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-quot-remove-monitor-quot-to-remove-security-event/m-p/539864#M90410 yuvkca4 2021-02-15T06:06:27Z