Getting Data In

How do I delete a duplicate data input

New Member

Somehow I have a duplicate remote directory input listed in my inputs it is in the format ///servername//direcotory// I also have it listed with the proper UNC path like \servername\director\ Both seem to be collecting. When I try to remove the first one I get the error Error occurred attempting to disable \\ncmec-radius\service\: In handler 'monitor': Object disabling requires user and application to be specified.

Any idea how I remove this?

Tags (2)
0 Karma
1 Solution

Communicator

I'm not a Windows guy but...assuming Splunk *nix operates in the same way. Go to where the 'inputs.conf' file is - typically $SPLUNK_HOME/etc/apps/search/local/ and remove the duplicate directory entry. I would recommend first stopping splunk, editing the file, and then restarting.

View solution in original post

Communicator

I'm not a Windows guy but...assuming Splunk *nix operates in the same way. Go to where the 'inputs.conf' file is - typically $SPLUNK_HOME/etc/apps/search/local/ and remove the duplicate directory entry. I would recommend first stopping splunk, editing the file, and then restarting.

View solution in original post

Communicator

Marking my answer as helpful is always appreciated 🙂

0 Karma

New Member

Thanks, that did it!

0 Karma

New Member

Thanks I will try this now.

0 Karma