This questions was asked before, but still haven't gotten a really good answer out of it. Or maybe I'm just doing this all wrong.
I'm trying to use Splunk Light to monitor the Security Logs of several Windows devices. Whenever I add a new host to monitor, rather than being able to add the host to the Server Class that I have called "Windows Hosts" in the "Data Inputs -> Event Logs Collections" page, I have to create a new Server Class and add all the hosts again to the new class. If I try to click on the existing Server Class to edit it, I get a "Page Not Found" message.
Is this correct? Am I doing something wrong? Is Light only supposed to be used for one device?
The best answer I could find out is the one I posted here:
Deployment server does not work in Splunk Light today. Because Splunk Light and Splunk Enterprise share a code base and the UI is defined by licensing, there are a few defects where features that are only available in Enterprise partially appear in Light. That is why you are seeing that server class link.
It seems you're into a buggy area of the product here. If your suggestion works for you, try it! And if you are a paying customer, I suggest opening a Support case for this.