thank you so much @gcusello  this worked 🙂  ... View more

Hi @gcusello    I am struggling to edit the inputs.conf file. I read from splunk documentation that it is recommended to copy it in local dir rather than changing it in defaults directory. However, this apps inputs.conf is already in local directory is not editable. it has write permissions, but still not able to edit. what is the way forward?   thank you for your help   Thanks Charandeep ... View more

Thank you @gcusello  for explaining it. I can disable for this input as of now. I have to do it in deployment server as well, right? Is it possible to see what all data-sources are for an index? ... View more

Hi @gcusello  ofcourse, this is inputs.conf mentions [monitor:///opt/apache/logs/access.log.*] disabled = false index = oc_test sourcetype = apache_access   I am interested in disabling log forwarding to this index only and the relevant log file is from apache, which is ofcourse needs to be disabled. ... View more

HI Giuseppe   Thank you for your response. I found relevant log file and index details in the search apps, not any other though. in the app.conf of the app , I found that this is default from splunk and used for indexes, however in inputs.conf, it mentioned only one index which I am interested. will it impact the others if I disable it in inputs.conf? ... View more