We have a fresh Splunk 6.3 install. We literally have 0 data currently indexing. When I click Settings -> Data Inputs. I am getting the error: 500 Internal Server Error Return to Splunk home page View more information about your request (request ID = tonsofnumbersandletters) in Search This page was linked to from http://x.x.x.x:8000/en-US/app/search/search. You are logged into x.x.x.x:8000 as admin, which is connected to splunkd @ xxx When I attempt to search error logs for the specific request ID, nothing populates. There is nothing in any of the error logs referencing this error. I have attempted several searches on Splunk Answers and this seemed to be a common thing for 5.x. I have yet to see a response that works with my issue. I also installed S.o.S (Splunk on Splunk) and do not see anything out of the ordinary that would cause this issue. Both the search head and Indexer are CentOS 7 running with the user Splunk, not root. I am running out of ideas. Any help is appreciated. P.S. When I go into Settings - Add Data. I am able to load that properly, but I am not able to view the data inputs. ... View more

Here is my question. List A has 150 hosts. Imported 3 weeks ago. Mostly static addresses, some dynamic List B has 300 hosts. Imported 1 week ago. Some static, most dynamic How does splunk handle the following: 1) If there is an asset in List A but not List B, does Splunk remove the asset or does it keep it? 2) If there is an updated DNS or IP address, does it create two entries for that specific assets? -Specifically if there is a host with an updated dynamic IP address, does it keep both entries? -If there is an old IP address in Splunk that is reused and now becomes a static IP address for a server, what DNS would Splunk show? 3) If there are assets in List A and List B, does it duplicate the asset entry? ... View more