Error occurred during trying to delete an Data TCP Input

[AchimK]

I have the problem that I can't delete an input filter that I probably formulated incorrectly so that I can take it out.

Error occurred attempting to remove a.b.*.*, c.d.e.0, f.g.*:5514: Malformed IP address: a.b.*.*, c.d.e.0, f.g.*:5514.

An outputs.conf under /system/local does not exist

[scelikok · Accepted solution]

Hi @AchimK,

You should delete colon before the port number like below. Or why don't you just delete this stanza from inputs.conf ?

[tcp://5514]
connection_host = ip
host = splunkindex
index = linux
sourcetype = linux_messages_syslog
disabled = 1

[AchimK]

Hi @scelikok 

it works, sorry for the delay. Today I  checked it.

Best regards

AchimK

[AchimK]

Hi scelikok,

I killed the IP's restart splunk, but the data input with port 5514 is not deletable

Error occurred attempting to remove :5514: Malformed IP address: :5514.

here the inputs file

[splunktcp://9997]
connection_host = ip

[tcp://:5514]
connection_host = ip
host = splunkindex
index = linux
sourcetype = linux_messages_syslog
disabled = 1

[scelikok]

Hi @AchimK,

You should check input settings inside inputs.conf file. If you created this input using GUI it may be under search app. You can find the place using btool like below.

splunk btool inputs list tcp --debug | grep 5514

This will show the path of inputs.conf file that you should edit to delete malformed TCP input.