Hi @Jcath  Can you confirm that the ownership of all the files in $SPLUNK_HOME/etc/system/default are set to the correct user that splunk is running as (usually 'splunk') . Unless you have removed any default files Splunk should be able to read the default values from the web.conf there so it seems like it could be a permissions issue. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

i have solved this problem. It is because i hadn't change my hostname on httpinput. The way to do this is: - Go to "/etc/apps/splunk_httpinput/local/inputs.conf" on your splunk enterprise - add this code line to change your hostname: [default] host = <your-IP> - restart splunk Hope this helps ... View more