topic Re: Windows Universal Forwarder - initial configuration settings dont seem to be in *.conf in Getting Data In

Windows Universal Forwarder - initial configuration settings dont seem to be in *.conf

bbegyperkspot — Wed, 30 Apr 2014 19:51:37 GMT

When installing a UF on Windows, the installer prompts for sources to forward, including event logs or a path.

I put in a path to some IIS logs but have come to regret my decision. I want to change the values, but I can't find them.

They aren't in

C:\Program Files\SplunkUniversalForwarder\etc\system\local\outputs.conf

C:\Program Files\SplunkUniversalForwarder\etc\system\default\outputs.conf

Where are the settings captured during the install and how can I change them?

Re: Windows Universal Forwarder - initial configuration settings dont seem to be in *.conf

somesoni2 — Mon, 28 Sep 2020 16:30:34 GMT

The conf file to look for will be inputs.conf. Search inputs.conf in following locations

C:\Program Files\SplunkUniversalForwarder\etc\system\local
C:\Program Files\SplunkUniversalForwarder\etc\system\default
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local

Re: Windows Universal Forwarder - initial configuration settings dont seem to be in *.conf

bbegyperkspot — Wed, 30 Apr 2014 22:13:29 GMT

Ok, found it under SplunkTAwindows. So which is the preferred location to declare directories I want monitored?