https://community.splunk.com/t5/Getting-Data-In/changes-to-config-files/m-p/113221#M23688 <P>These should help you get started</P> <P>Distributed Splunk Architecture: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Deploy/Distributedoverview">http://docs.splunk.com/Documentation/Splunk/6.2.2/Deploy/Distributedoverview</A></P> <P>Indexer configuration<BR /> Index Creation: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setupmultipleindexes">http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setupmultipleindexes</A><BR /> Props entries/sourcetype definition: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Createsourcetypes">http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Createsourcetypes</A></P> <P>Forwarder configuration<BR /> Outputs.conf: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Configureforwarderswithoutputs.confd">http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Configureforwarderswithoutputs.confd</A><BR /> Inputs.conf: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Editinputs.conf">http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Editinputs.conf</A></P> Mon, 23 Mar 2015 17:51:37 GMT somesoni2 2015-03-23T17:51:37Z https://community.splunk.com/t5/Getting-Data-In/changes-to-config-files/m-p/113220#M23687 <P>Hi..<BR /> I was used to using splunk as a single instance in my laptop. I am new to forwarders and indexes. I have log data in the form of csv files available(with headers) . Assuming data is in /abc/data_files and splunk forwarder files are in /abc/splunkforwarder/etc/system/local. <BR /> In the local I only find these files <BR /> deploymentclient.conf, inputs.conf, outputs.conf, README, server.conf. <BR /> When I opened inputs.conf and outputs.conf I found them to be empty. </P> <OL> <LI>How do I make the forwarder to pick the files from the location and start loading the data. </LI> <LI>How do I create a new index so that I can handle the data better. </LI> <LI>Why is there no props.conf file? Dont I need it? Why are the other files empty? </LI> </OL> <P>I do not know if I am even in the right direction in wanting to make changes in the forwarder. I am really lost. Please consider me to be a beginner. Please let me step by step or point me to a document to figure out how to do this? </P> Mon, 23 Mar 2015 15:41:01 GMT https://community.splunk.com/t5/Getting-Data-In/changes-to-config-files/m-p/113220#M23687 sundaresh83 2015-03-23T15:41:01Z https://community.splunk.com/t5/Getting-Data-In/changes-to-config-files/m-p/113221#M23688 <P>These should help you get started</P> <P>Distributed Splunk Architecture: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Deploy/Distributedoverview">http://docs.splunk.com/Documentation/Splunk/6.2.2/Deploy/Distributedoverview</A></P> <P>Indexer configuration<BR /> Index Creation: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setupmultipleindexes">http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setupmultipleindexes</A><BR /> Props entries/sourcetype definition: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Createsourcetypes">http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Createsourcetypes</A></P> <P>Forwarder configuration<BR /> Outputs.conf: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Configureforwarderswithoutputs.confd">http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Configureforwarderswithoutputs.confd</A><BR /> Inputs.conf: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Editinputs.conf">http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Editinputs.conf</A></P> Mon, 23 Mar 2015 17:51:37 GMT https://community.splunk.com/t5/Getting-Data-In/changes-to-config-files/m-p/113221#M23688 somesoni2 2015-03-23T17:51:37Z