topic Re: Why is there nothing in inputs.conf after Universal Forwarder install, and selecting all the options in Getting Data In

Why is there nothing in inputs.conf after Universal Forwarder install, and selecting all the options

neiljpeterson — Thu, 05 Dec 2013 18:41:33 GMT

I am just trying to do a quick proof of concept / demo of Spunk.

I installed the Universal Forwarder, and selected all the inputs in the GUI installer, plus selected a directory of log files. After the install my inputs.conf is empty. I could manually add these, but why is the installer not writing my selections to the file? Or am I missing something?

I am running the x64 version in on Windows Server 2008

This is all my inputs.conf has

[default]
host = DEV-WEBDEV1

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

Re: Why is there nothing in inputs.conf after Universal Forwarder install, and selecting all the options

lukejadamec — Thu, 05 Dec 2013 18:44:19 GMT

On a Windows box you will find the install created inputs in the splunk\etc\apps\MSICreated\local folder.

Re: Why is there nothing in inputs.conf after Universal Forwarder install, and selecting all the options

neiljpeterson — Thu, 05 Dec 2013 18:47:21 GMT

On the host I am forwarding from? I don't see that dir on the host

Re: Why is there nothing in inputs.conf after Universal Forwarder install, and selecting all the options

neiljpeterson — Thu, 05 Dec 2013 18:49:26 GMT

Ok I actually found the correct file.

It was located in

C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local

Is this somewhere in the documentation and I missed it?

Why is there multiple

\etc\local

folders and multiple input.conf s?