UF inputs.conf stanza

ITSplunk117 — Wed, 28 Dec 2022 15:25:40 GMT

I'm working on an input.conf from a universal forwarder when I noticed the first stanza is missing a ]

ex:
[WinEventLog://Application instead of [WinEventLog://Application]

Since I do not have direct access to the UF to check the logs. What effect, if any, would this have on log ingestion?

thanks

Re: UF inputs.conf stanza

gcusello — Wed, 28 Dec 2022 15:43:11 GMT

Hi @ITSplunk117,

if you are able to see the Splunk restart on that forwarder you'll see that a configuration error was found.

Anyway, the input stanza isn't running and you haven't those data.

You have two way to solve yur issue:

if you're using a Deployment Server to manage Forwarders, you can correct the error in the app to deploy and deploy it again.

If you aren't using a DS (it isn't a good idea and possible only for little labs uses), you have to manually correct the error accessing the inputs.conf file and after restarting Splunk on the Forwarder.

Ciao.

Giuseppe

Ciao.

Giuseppe

topic Re: UF inputs.conf stanza in Getting Data In

UF inputs.conf stanza

Re: UF inputs.conf stanza