https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-modify-inputs-conf-on-our-Windows-universal/m-p/170352#M34427 <P>I would create a "splunk_TA_Windows_hostoverride" app and use IP-based stanzas in props.conf to override the hosts as necessary after the fact.</P> Mon, 28 Sep 2020 19:53:14 GMT woodcock 2020-09-28T19:53:14Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-modify-inputs-conf-on-our-Windows-universal/m-p/170351#M34426 <P>Hi,</P> <P>I am trying to manage the universal forwarders on all our Windows system using the deployment server. They all have the same app (splunk_TA_windows) but the <CODE>inputs.conf</CODE> are all different on each server. Is it possible to manage this via <CODE>serverclass.conf</CODE>? </P> <P>For example:</P> <P>server 1 inputs.conf:</P> <P>[WinEventLog://Application]<BR /> disabled = 0<BR /> start_from = oldest<BR /> current_only = 0<BR /> index = main<BR /> host =develop</P> <P>server 2 inputs.conf:</P> <P>[WinEventLog://Application]<BR /> disabled = 0<BR /> start_from = oldest<BR /> current_only = 0<BR /> index = main<BR /> host =staging</P> <P>Thanks,<BR /> Milan</P> Mon, 28 Sep 2020 19:43:40 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-modify-inputs-conf-on-our-Windows-universal/m-p/170351#M34426 mjesudasan 2020-09-28T19:43:40Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-modify-inputs-conf-on-our-Windows-universal/m-p/170352#M34427 <P>I would create a "splunk_TA_Windows_hostoverride" app and use IP-based stanzas in props.conf to override the hosts as necessary after the fact.</P> Mon, 28 Sep 2020 19:53:14 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-modify-inputs-conf-on-our-Windows-universal/m-p/170352#M34427 woodcock 2020-09-28T19:53:14Z