topic Re: Which configuration file do I make changes to on Windows hosts to add additional directories to monitor and where is this located? in Getting Data In

Which configuration file do I make changes to on Windows hosts to add additional directories to monitor and where is this located?

attraqt — Wed, 26 Nov 2014 11:25:41 GMT

hi guy's.

recently added some windows hosts to our environment and they are forwarding data fine to our system. i want to add additional directories to monitor on the windows hosts but can't find the relevant config file to amend?

Re: Which configuration file do I make changes to on Windows hosts to add additional directories to monitor and where is this located?

MuS — Wed, 26 Nov 2014 11:30:47 GMT

Hi attraqt,

you're looking for inputs.conf read the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Inputsconf about the monitor stanza ... asking what a stanza is? read the docs as well http://docs.splunk.com/Splexicon:Stanza 🙂

cheers, MuS

Re: Which configuration file do I make changes to on Windows hosts to add additional directories to monitor and where is this located?

attraqt — Wed, 26 Nov 2014 14:49:04 GMT

Thanks for the docs Mus.

Having a look at the inputs.conf fiels listed and i can't see any of the configurations i made during the forwarder msi install. I've checked the local and defaults inputs.conf?

Re: Which configuration file do I make changes to on Windows hosts to add additional directories to monitor and where is this located?

MuS — Wed, 26 Nov 2014 14:53:39 GMT

check as well in $SPLUNK_HOME/etc/apps for any inputs.conf where $SPLUNK_HOME is the path where you installed the Splunk UF.

Re: Which configuration file do I make changes to on Windows hosts to add additional directories to monitor and where is this located?

attraqt — Wed, 26 Nov 2014 14:58:08 GMT

Ok cool. Looks like i found the correct path:

C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local