When i will add tcp port 514 then comes that:
Encountered the following error while trying to save: In handler 'raw': Unable to find pipeline with name tcp.
So when i enable comes:
"Error occurred attempting to enable 514: In handler 'raw': Unable to find pipeline with name tcp.."
Why come this errors?
i have found that problem. The SplunkLightForwarder was enable.-.-
sorry for the question
2 possible reasons:
-Another application is using TCP port 514
-In your Splunk there is somewhere an inputs.conf with tcp 514 (search in splunk/etc/system/local or in any app folder splunk/etc/apps/