topic Re: Deployment Server App Confusion in Deployment Architecture

Deployment Server App Confusion

knutsod — Tue, 24 Jun 2014 20:04:20 GMT

I created a deployment app, lets call it windows. Inisde Windows\Local\ I have an input.conf and an outputs.conf file. My input.conf file looks like this:
[WinEventLog:Security] disabled = flase
When the app gets delived to the clients (Windows Universal Forwarders) the input.conf file in the deployed app looks like this:
[WinEventLog://Security] disabled = 1

What the heck is going on?

Re: Deployment Server App Confusion

martin_mueller — Tue, 24 Jun 2014 20:11:50 GMT

You may have a typo, flase instead of false.

Nonetheless, the inputs.conf reference suggests 0 or 1 as values. http://docs.splunk.com/Documentation/Splunk/6.1.1/admin/inputsconf

Re: Deployment Server App Confusion

knutsod — Tue, 24 Jun 2014 20:13:59 GMT

That was it... I feel stupid. I think I need to step away from my desk and get some air. Thanks!

Re: Deployment Server App Confusion

knutsod — Tue, 24 Jun 2014 20:16:23 GMT

False was spelled wrong, thanks to martin_mueller for pointing that out.

Re: Deployment Server App Confusion

martin_mueller — Tue, 24 Jun 2014 20:16:52 GMT

I'm sure you could build a Splunk alert that tells users to take a break if they've been Splunking along for more than X hours...