- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to remove the inputs that are given at time of...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to remove the inputs that are given at time of universal forwarder installation
Hi
I've installed the splunk indexer on linux machine and universal forwader on a windows machine.While installing universal forwader - at the Installation wizard I gave some basic inputs to enable like CPU load,disk space and system log in windows but I dont want to monitor this any more so I need to remove this info.I have cleared the inputs.conf under $SPLUNKHOME/etc/apps/MSICreated/inputs.conf and $SPLUNKHOME/etc/system/local/inputs.conf but still the inputs ' CPU load,disk space and system log' is shown in splunk web console
How do I remove the above inputs from indexing please?
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
etc/system/apps/unix/local
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i am sorry, I misread your question. disregard my answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
where this path will be please?
I can't find it in universal forwarder(windows) or in indexer
the only local folder is /etc/system/local and /etc/apps/MSICreated/local
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do any one have any clue on this please?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
run:
splunk cmd btool inputs list --debug
This will give you all of the configured inputs, and their properties. the first column will indicate which app has configured that input.
Is the data you're seeing possibly from before the inputs were removed? Did you restart after modifying the inputs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
there is nothing configured in the etc/system/local/inputs.conf but I can see few entries in etc/system/default/inputs.conf - is it taking input from there?
I can confirm it is the new data being indexed,not the old one because even after deleting the old data from index I can see the updated data again..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This should be simple to fix, if you're interested and could join #splunk on EFNet we could knock this out pretty easy. http://cbe002.chat.mibbit.com/ is one webclient
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Would need to see you're etc/system/local/inputs.conf if it's not configured in there, then there's no reason why it should be still getting data if you've restarted. Can you confirm that new data is still being indexed, not just seeing old data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
anyone know this please?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I executed the above command and in the outputs listed I can't see the 'CPU load,disk space and system log'.the first column displays only one app - system.
yes I restarted twice after removing the inputs.conf
any other suggestions please?
Introducing the 2024 SplunkTrust!
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
