topic Re: Default apps in Universal Forwarder, is any of them unnecessary? in Getting Data In

Are any default apps in universal forwarder unnecessary?

hectorvp — Thu, 22 Dec 2022 14:51:47 GMT

I just installed universal forwarder,

And was deploying my first app using DS, I came accros few apps in place prior to what I configure on UF.

Path: \etc\apps\

Apps found are:

introspection_generator_addon

learned

searched

splunk_httpinput

splunk_internal_metrics

SplunkUniversalForwarder

Is any them unnecessary and can I remove?

Re: Default apps in Universal Forwarder, is any of them unnecessary?

richgalloway — Fri, 25 Sep 2020 13:46:51 GMT

Any apps already in place before the UF receives anything from the DS is standard Splunk and shouldn't be touched.

Re: Default apps in Universal Forwarder, is any of them unnecessary?

Jagadeesh2022 — Thu, 22 Dec 2022 12:18:44 GMT

Hi @richgalloway

In my case, more volume of data produced from Learned app. Is there any possibility to disable this app: learned?

If we can't disable how to stop generate logs from this app: learned ?

Your response is much appreciated.

Regards,

Jagadeesh

@gcusello @ITWhisperer

Re: Default apps in Universal Forwarder, is any of them unnecessary?

richgalloway — Thu, 22 Dec 2022 14:03:36 GMT

This question is more than 2 years old with an accepted answer. You should have posted a new question.

The learned app is invoked when data is received without a sourcetype. To avoid using the app, ensure all data ingested by Splunk has a sourcetype associated with it and that sourcetype is configured in props.conf.

Re: Default apps in Universal Forwarder, is any of them unnecessary?

Jagadeesh2022 — Thu, 22 Dec 2022 18:27:18 GMT

@richgalloway

Sorry to updated in the older question.

Thanks for your response. My last question. If we just mention sourcetype in input.conf is not enough?

I should to mention the same sourcetype again in props.conf ?

Thanks in advance.

Re: Default apps in Universal Forwarder, is any of them unnecessary?

richgalloway — Thu, 22 Dec 2022 20:14:30 GMT

If a sourcetype is not in props.conf then it doesn't exist. Mentioning it in inputs.conf alone is not enough. Props.conf is where the properties of the sourcetype are specified. Without them, Splunk has to guess about the sourcetype and often guesses wrong.