topic In a Windows forwarder install, I specified a log directory to monitor. Which inputs.conf does that get written in? in Getting Data In

In a Windows forwarder install, I specified a log directory to monitor. Which inputs.conf does that get written in?

dvietze — Wed, 15 Apr 2015 20:23:14 GMT

During the Windows forwarder install I specified a path to monitor, and it is working, but it isn't in /splunk_home/etc/system default or local inputs.conf. Where is it? Thanks!

Re: In a Windows forwarder install, I specified a log directory to monitor. Which inputs.conf does that get written in?

harsmarvania57 — Wed, 15 Apr 2015 20:24:57 GMT

Check in $SPLUNK_HOME/etc/apps/app name/default/inputs.conf OR $SPLUNK_HOME/etc/apps/app name/local/inputs.conf
I think app name starts with MSI but I am not sure.

Re: In a Windows forwarder install, I specified a log directory to monitor. Which inputs.conf does that get written in?

krish3 — Thu, 16 Apr 2015 08:42:28 GMT

If you added inputs from splunk home then it should be in

$SPLUNK_HOME/etc/apps/launcher/local/inputs.conf

If you added inputs from search and reporting app then it should be in

$SPLUNK_HOME/etc/apps/search/local/inputs.conf

else if you didnt get it still... You should be able to see the inputs by executing below command from splunk CLI.

splunk cmd btool inputs list monitor