topic Re: Why are new UDP data inputs for multiple hosts initially disabled after creation? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124301#M25629 <P>Did you bump Splunk after making the change in the .conf file? Either by restarting or by hitting this URL:</P> <PRE><CODE><A href="http://your_host:8000/en-US/debug/refresh?entity=admin/conf-inputs" target="test_blank">http://your_host:8000/en-US/debug/refresh?entity=admin/conf-inputs</A> </CODE></PRE> Thu, 16 Jul 2015 18:48:31 GMT martin_mueller 2015-07-16T18:48:31Z Why are new UDP data inputs for multiple hosts initially disabled after creation? https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124294#M25622 <P>Creating new UDP Data Inputs for received syslog data from specific hosts to go to a specific Index. After creating the data input with multiple hosts (comma delimited) the status is initially disabled. I have no problem enabling afterwards, but wondering if multiple hosts aren't allowed and that is why it is disabled or is it just a precaution?</P> Wed, 15 Jul 2015 17:51:26 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124294#M25622 xxyz 2015-07-15T17:51:26Z Re: Why are new UDP data inputs for multiple hosts initially disabled after creation? https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124295#M25623 <P>How are you creating the inputs?</P> Wed, 15 Jul 2015 18:22:22 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124295#M25623 martin_mueller 2015-07-15T18:22:22Z Re: Why are new UDP data inputs for multiple hosts initially disabled after creation? https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124296#M25624 <P>through the gui: settings &gt; data inputs &gt; &gt; udp &gt; new</P> <P>is there a conf to do this?</P> Wed, 15 Jul 2015 18:27:20 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124296#M25624 xxyz 2015-07-15T18:27:20Z Re: Why are new UDP data inputs for multiple hosts initially disabled after creation? https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124297#M25625 <P>Yeah, inputs.conf </P> Wed, 15 Jul 2015 23:13:44 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124297#M25625 martin_mueller 2015-07-15T23:13:44Z Re: Why are new UDP data inputs for multiple hosts initially disabled after creation? https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124298#M25626 <P>interesting. normally configurations adding in the gui update conf files under local, but these additions do not. </P> Thu, 16 Jul 2015 14:39:16 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124298#M25626 xxyz 2015-07-16T14:39:16Z Re: Why are new UDP data inputs for multiple hosts initially disabled after creation? https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124299#M25627 <P>so i added them all in. no problems. they show up in the gui just fine. however...</P> <P>when i set a stanza to collect all syslog traffic and direct it to index 'syslog', it doesn't show in the gui. so will this work even though it's not showing?</P> <P>[udp:514]<BR /> index = syslog<BR /> sourcetype = syslog<BR /> connection_host = ip</P> Thu, 16 Jul 2015 15:48:24 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124299#M25627 xxyz 2015-07-16T15:48:24Z Re: Why are new UDP data inputs for multiple hosts initially disabled after creation? https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124300#M25628 <P>All UI settings <STRONG>must</STRONG> appear under local directories, else they would be lost on an upgrade of Splunk.<BR /> Make sure you've not just checked the wrong app and keep <CODE>system/local</CODE> in mind.</P> Thu, 16 Jul 2015 18:46:54 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124300#M25628 martin_mueller 2015-07-16T18:46:54Z Re: Why are new UDP data inputs for multiple hosts initially disabled after creation? https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124301#M25629 <P>Did you bump Splunk after making the change in the .conf file? Either by restarting or by hitting this URL:</P> <PRE><CODE><A href="http://your_host:8000/en-US/debug/refresh?entity=admin/conf-inputs" target="test_blank">http://your_host:8000/en-US/debug/refresh?entity=admin/conf-inputs</A> </CODE></PRE> Thu, 16 Jul 2015 18:48:31 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-new-UDP-data-inputs-for-multiple-hosts-initially/m-p/124301#M25629 martin_mueller 2015-07-16T18:48:31Z