Getting Data In

Error deleting data input

spersels
New Member

So I'll ask again since previous question seems to have been lost. Sorry if this appears to be a duplicate. I'm getting the following error and cannot delete this data input.

Error occurred attempting to remove <data input>: In handler 'remote_monitor': The following required arguments are missing: app_name..

Tags (2)
0 Karma

jmorgan_
Explorer

As a new Splunk user, this is hugely frustrating. Trying to get even a basic setup going feels like walking through a minefield. Not being able to remove Data Inputs from the web console and then having to find which inputs.conf these settings are stored in. When you combine it with the fact that you cannot edit Server Classes (see here), the new user experience is pretty awful. Splunk seems like a great tool, but it is hard to justify the time to get it up and running. There is a difference between complicated and buggy.

jmorgan_
Explorer
0 Karma

BlueSocket
Communicator

Hi! I am also having the same problem with one of my data inputs and I cannot do anything with it at all.

Does anyone know what I can do with my data input? I am using Splunk 6.2.3.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you have access to the CLI, edit the inputs.conf file to remove the `` stanza. Then restart Splunk. The trick is finding the right file to modify. Start with SPLUNK_HOME/etc/system/local/inputs.conf then look in SPLUNK_HOME/etc/apps/*/local/inputs.conf.

---
If this reply helps you, Karma would be appreciated.
0 Karma

spersels
New Member

I see the stanza on the forwarder in C:\Program Files\SplunkUniversalForwarder\etc\apps\_server_app_Laptops\local\inputs.conf.

1) Do I need to use the CLI to delete the entry or can I use notepad?

2) Is there anything I need to do on the master - i.e. once I delete it from the forwarder will master pick that up remove the that item from the list on the Data Inputs screen

3) this happens frequently. Is this a know problem? Is there something I'm doing that's causing this? I'm not editing any config files manually or any other fancy/intrusive stuff. Just using the web adminstration tools provided out of the box. This is a bare bones, newly installed uncustomized 6.2 install. One enterprise server and one universal forwarder. Enterprise running on Windows 2012, universal forwarder running on Windows 7.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...