topic Re: Configure input.conf for universal forwader in Getting Data In

Configure input.conf for universal forwader

splunker_123 — Tue, 19 Jun 2012 18:22:22 GMT

I've installed splunk indexer on a linux server and universal splunk forwarder on a windows machine,while installing the universal forwader I enabled few logs for forwarding such as

1 WinEventLog:Application
2 WinEventLog:System
3 Perfmon:CPU Load
4 Perfmon:Available Memory
5 Perfmon:Free Disk Space

And this is working as I see this the above splunk indexer ,NOw I want to remove this one and point my application logs in the universal forwader so that I can view the application logs in indexer
How to do this? I tried to do this by editing the input.conf file at /splunkhome/etc/system/local - but no luck - also I need to give new inputs such as my application logs - where do I add this in universal forwader?I'm kind of confused between inputs.conf and output.conf- Can any one please help

Re: Configure input.conf for universal forwader

yannK — Wed, 20 Jun 2012 05:56:39 GMT

please look in $SPLUNK_HOME\etc\apps\<nameoftheapp>\local\input.conf
the app folder name may be MSIinstaller*, but i am not 100% sure.
You should find the ones built by the installer wizard, and use them a model to add new ones.

Re: Configure input.conf for universal forwader

Ayn — Wed, 20 Jun 2012 07:30:32 GMT

Note that the file should be called inputs.conf, not input.conf.

Re: Configure input.conf for universal forwader

splunker_123 — Wed, 20 Jun 2012 08:57:47 GMT

Are you saying that I have to edit the inputs.conf under $SPLUNK_HOME\etc\apps\MSlinstaller\input.conf and not under system\local\inputs.conf?

Re: Configure input.conf for universal forwader

yannK — Wed, 20 Jun 2012 14:57:57 GMT

You can edit either, at the end splunk merges all the configuration from every enabled app and system.

What I was saying is that the inputs created by the windows installer are usually in an app named "MSIsomething". If you want to use them as model.