How do I add data into Splunk when logged in as an administrator?

[swarnendu30]

When i am adding data on Splunk Enterprise, I see:

You do not have the capability to add data. Please contact your administrator. 

But I am logged in as an administrator user.

How do I add data into Splunk?

[aaraneta_splunk]

@swarnendu30 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

[davidpaper]

You must have indexing disabled on that server (maybe a forwarder)? Either re-enable indexing on that instance, or try to create the data input on a Splunk instance that has indexing enabled.

[rodrigorsilva]

Hi,

A simple way for a first contact:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Howdoyouwanttoadddata

For other options, you can try to do this:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Configureyourinputs

Tks

Rodrigo Ribeiro

[cmerriman]

http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Getstartedwithgettingdatain

have you looked through this doc to get data into Splunk? There are multiple ways. Are you doing this through the GUI or through .conf files?