https://community.splunk.com/t5/Getting-Data-In/Details-on-disabled-flag-in-inputs-conf/m-p/97164#M20259 <P>Default is <CODE>false</CODE>, meaning inputs will by default be enabled unless anything else is specified. I include it out of habit, and because it provides a simple way for people doing changes to see where they can change if they want to disable an input. But, other than for brevity, there's no real reason to include <CODE>disabled = false</CODE> for an input that's supposed to be enabled (that I know of that is).</P> Thu, 12 Jul 2012 17:55:44 GMT Ayn 2012-07-12T17:55:44Z https://community.splunk.com/t5/Getting-Data-In/Details-on-disabled-flag-in-inputs-conf/m-p/97163#M20258 <P>In many examples (on splunk.com, in training class slides, and elsewhere) I see a "disabled = false" setting in many inputs.conf <CODE>[monitor]</CODE> stanzas. However, the only documentation I see for this setting is on <A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf">http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf</A> and it doesn't list what the default is, for example. Are there other docs with more details on the setting, what the default is, and why it is included in many example stanzas but not all? In particular, do I need to be adding this setting to all my [monitor] stanzas?</P> Thu, 12 Jul 2012 16:42:32 GMT https://community.splunk.com/t5/Getting-Data-In/Details-on-disabled-flag-in-inputs-conf/m-p/97163#M20258 Jordan_Brough 2012-07-12T16:42:32Z https://community.splunk.com/t5/Getting-Data-In/Details-on-disabled-flag-in-inputs-conf/m-p/97164#M20259 <P>Default is <CODE>false</CODE>, meaning inputs will by default be enabled unless anything else is specified. I include it out of habit, and because it provides a simple way for people doing changes to see where they can change if they want to disable an input. But, other than for brevity, there's no real reason to include <CODE>disabled = false</CODE> for an input that's supposed to be enabled (that I know of that is).</P> Thu, 12 Jul 2012 17:55:44 GMT https://community.splunk.com/t5/Getting-Data-In/Details-on-disabled-flag-in-inputs-conf/m-p/97164#M20259 Ayn 2012-07-12T17:55:44Z