Why are new UDP data inputs for multiple hosts initially disabled after creation?

[xxyz]

Creating new UDP Data Inputs for received syslog data from specific hosts to go to a specific Index. After creating the data input with multiple hosts (comma delimited) the status is initially disabled. I have no problem enabling afterwards, but wondering if multiple hosts aren't allowed and that is why it is disabled or is it just a precaution?

[martin_mueller]

Yeah, inputs.conf

[xxyz]

so i added them all in. no problems. they show up in the gui just fine. however...

when i set a stanza to collect all syslog traffic and direct it to index 'syslog', it doesn't show in the gui. so will this work even though it's not showing?

[udp:514]
index = syslog
sourcetype = syslog
connection_host = ip

[martin_mueller]

Did you bump Splunk after making the change in the .conf file? Either by restarting or by hitting this URL:

http://your_host:8000/en-US/debug/refresh?entity=admin/conf-inputs

[xxyz]

interesting. normally configurations adding in the gui update conf files under local, but these additions do not.

[martin_mueller]

All UI settings must appear under local directories, else they would be lost on an upgrade of Splunk.
Make sure you've not just checked the wrong app and keep system/local in mind.

[martin_mueller]

How are you creating the inputs?

[xxyz]

through the gui: settings > data inputs > > udp > new

is there a conf to do this?