have a distributed Splunk 6 environment with which I am working through the installation of a new Technology Add-on. On my forwarder I am trying to add a new Data Input... Settings > Data inputs > Files & directories > New then select my file and click Next... on the Set Sourcetype page the message "Cannot preview on this Splunk instance" appears.
I have numerous other Data Input set up in the same manner and even another file from the same directory as this file that is throwing the message. The directory is local to the Linux box the fowarder is on and I already verified permissions on the file.
Still completely wet behind the ears with https://goo.gl/dsWj8C Splunk and stuck troubleshooting this problem.