When i am adding data on Splunk Enterprise, I see:
You do not have the capability to add data. Please contact your administrator.
But I am logged in as an administrator user.
How do I add data into Splunk?
@swarnendu30 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!
You must have indexing disabled on that server (maybe a forwarder)? Either re-enable indexing on that instance, or try to create the data input on a Splunk instance that has indexing enabled.
Hi,
A simple way for a first contact:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Howdoyouwanttoadddata
For other options, you can try to do this:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Configureyourinputs
Tks
Rodrigo Ribeiro
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Getstartedwithgettingdatain
have you looked through this doc to get data into Splunk? There are multiple ways. Are you doing this through the GUI or through .conf files?