topic When I try to add or delete port 9997, why do I get the same "Error occurred attempting to remove 9997...Could not find config id for port"? in Getting Data In

When I try to add or delete port 9997, why do I get the same "Error occurred attempting to remove 9997...Could not find config id for port"?

alexlit — Thu, 03 Dec 2015 17:02:37 GMT

When I try deleting port 9997, I get the following problem:

Error occurred attempting to remove 9997: In handler 'cooked': Could not find config id for port 9997.

When I try to add port 9997, I get the following error message:

Error occurred attempting to remove 9997: In handler 'cooked': Could not find config id for port 9997.

Do you know what could be a problem? I am using Windows.

Re: When I try to add or delete port 9997, why do I get the same "Error occurred attempting to remove 9997...Could not find config id for port"?

lloydd518 — Tue, 29 Sep 2020 09:20:30 GMT

In your $splunk_home/etc/system/local/inputs.conf file...

is it an SSL type
[splunktcp-ssl:9997] listener ?

[SSL]
password=********(obfuscated out)
rootCA = /some_file_path/cacert.pem
serverCert = /some_file_path/server.pem

Mine is.. and I'm having a similar issue to you.

I'm using Splunk 6.3.2... what version are you using ?

Re: When I try to add or delete port 9997, why do I get the same "Error occurred attempting to remove 9997...Could not find config id for port"?

lguinn2 — Mon, 18 Apr 2016 16:06:23 GMT

When you say you are "trying to delete," what do you mean? Exactly what commands are you using?

You can always remove or change a port by editing the configuration file, and then restarting Splunk. So if $SPLUNK_HOME/etc/system/local/inputs.conf contains

[splunktcp-ssl:9997]

[SSL]
password=(obfuscated out)
rootCA = /some_file_path/cacert.pem
serverCert = /some_file_path/server.pem

[splunktcp://:9997]

You can change the 9997 to something else, or remove the entire stanza. (In this example, these are single-line stanzas.) Then restart Splunk so that your changes take effect.

Re: When I try to add or delete port 9997, why do I get the same "Error occurred attempting to remove 9997...Could not find config id for port"?

lloydd518 — Mon, 18 Apr 2016 17:37:47 GMT

Sorry, should have been more specific. This is all work that is being carried out from inside the Splunk UI.. it throws an error/exception.. cannot delete the receiving port...when trying to remove the receiver port 9997.
Wondered if it was a bug related to having not created my SSL receiving port in the UI (which you cant do anyway.. not a feature in the Splunk UI).
Wondered if it was a bug whereby you create a receiver in the CLI then try to remove it via the Splunk UI.

Re: When I try to add or delete port 9997, why do I get the same "Error occurred attempting to remove 9997...Could not find config id for port"?

lguinn2 — Tue, 19 Apr 2016 03:54:13 GMT

I would agree that an error/exception is a bug. Feel free to file a ticket with Splunk Support.

And I always recommend that you un-do something using the same technique as when you originally did it.