I see the stanza on the forwarder in C:\Program Files\SplunkUniversalForwarder\etc\apps\_server_app_Laptops\local\inputs.conf. 1) Do I need to use the CLI to delete the entry or can I use notepad? 2) Is there anything I need to do on the master - i.e. once I delete it from the forwarder will master pick that up remove the that item from the list on the Data Inputs screen 3) this happens frequently. Is this a know problem? Is there something I'm doing that's causing this? I'm not editing any config files manually or any other fancy/intrusive stuff. Just using the web adminstration tools provided out of the box. This is a bare bones, newly installed uncustomized 6.2 install. One enterprise server and one universal forwarder. Enterprise running on Windows 2012, universal forwarder running on Windows 7. ... View more