Somehow I have a duplicate remote directory input listed in my inputs it is in the format ///servername//direcotory// I also have it listed with the proper UNC path like \servername\director\ Both seem to be collecting. When I try to remove the first one I get the error Error occurred attempting to disable \\ncmec-radius\service\: In handler 'monitor': Object disabling requires user and application to be specified.
Any idea how I remove this?
I'm not a Windows guy but...assuming Splunk *nix operates in the same way. Go to where the 'inputs.conf' file is - typically $SPLUNK_HOME/etc/apps/search/local/ and remove the duplicate directory entry. I would recommend first stopping splunk, editing the file, and then restarting.
I'm not a Windows guy but...assuming Splunk *nix operates in the same way. Go to where the 'inputs.conf' file is - typically $SPLUNK_HOME/etc/apps/search/local/ and remove the duplicate directory entry. I would recommend first stopping splunk, editing the file, and then restarting.
Marking my answer as helpful is always appreciated 🙂
Thanks, that did it!
Thanks I will try this now.