https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-Inputs-Configuration/m-p/111838#M23418 <P>If you used the installer, then the input configuation is going to be in <CODE>Splunk\etc\apps\MSICreated\local\inputs.conf</CODE></P> Wed, 23 Oct 2013 17:06:04 GMT lukejadamec 2013-10-23T17:06:04Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-Inputs-Configuration/m-p/111837#M23417 <P>Version 5.0.5<BR /> Windows</P> <P>I installed the Universal Forwarder on my windows machine using the installation wizard. The forwarder is sending log files to the server correctly. What I'm trying to figure out is where the configuration file containing the directory that is being monitor is stored. I looked in etc/system/local/inputs.conf, but the values were not there. Any other thoughts? I'm puzzled where the forwarder is getting the directory to monitor.</P> Wed, 23 Oct 2013 16:59:54 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-Inputs-Configuration/m-p/111837#M23417 sjwone 2013-10-23T16:59:54Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-Inputs-Configuration/m-p/111838#M23418 <P>If you used the installer, then the input configuation is going to be in <CODE>Splunk\etc\apps\MSICreated\local\inputs.conf</CODE></P> Wed, 23 Oct 2013 17:06:04 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-Inputs-Configuration/m-p/111838#M23418 lukejadamec 2013-10-23T17:06:04Z