How do I delete a duplicate data input

[udiggity]

Somehow I have a duplicate remote directory input listed in my inputs it is in the format ///servername//direcotory// I also have it listed with the proper UNC path like \servername\director\ Both seem to be collecting. When I try to remove the first one I get the error Error occurred attempting to disable \\ncmec-radius\service\: In handler 'monitor': Object disabling requires user and application to be specified.

Any idea how I remove this?

[netwrkr · Accepted solution]

I'm not a Windows guy but...assuming Splunk *nix operates in the same way. Go to where the 'inputs.conf' file is - typically $SPLUNK_HOME/etc/apps/search/local/ and remove the duplicate directory entry. I would recommend first stopping splunk, editing the file, and then restarting.

[netwrkr]

Marking my answer as helpful is always appreciated 🙂

[udiggity]

Thanks, that did it!

[udiggity]

Thanks I will try this now.