https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-inputs-conf-from-a-deployed-app-is-not/m-p/229191#M44585 <P>check </P> <P>the powershell execution policy on the w7 machine<BR /> is the deployment server running windows? if show check file permissions<BR /> try another simple inputs.conf to monitor a file on the desktop (or similar) to check the deployment and client funtionality</P> <P>search <CODE>index=_internal error host=myw7machine</CODE>` to check for app deployment issues</P> <P>as a start....</P> Wed, 02 Mar 2016 02:33:00 GMT 0YAoNnmRmKDg 2016-03-02T02:33:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-inputs-conf-from-a-deployed-app-is-not/m-p/229190#M44584 <P>Hi,</P> <P>At the moment I am testing Splunk at work. So far, I only have a single Splunk Enterprise instance (acting as deployment server) and a Win7 workstation.<BR /> I created a simple app with the purpose of catching EMET events. Its inputs.conf file only contains the following lines:</P> <PRE><CODE>[WinEventLog://Application] disabled = 0 whitelist= SourceName="EMET" EventCode="(^1$|^2$|^11$|^50$)" [WinEventLog://Security] disabled = 1 [WinEventLog://System] disabled = 1 </CODE></PRE> <P>I created the app in the server, created the server class for Windows 7 workstations and assigned the app to that server class. <BR /> After restarting both Splunk server and the client, the app files are copied to the client, but it doesn't seem to filter anything.</P> <P>In order to to do some troubleshouting, I run in the client the following debug command: </P> <PRE><CODE>splunk cmd btool inputs list --debug </CODE></PRE> <P>and I can see in the output that the file was partially parsed... only one line appears to be taken... the two lines <CODE>disabled =1</CODE> were omitted.</P> <P>Any idea what can be happening? Any tip I could follow?</P> <P>Many thanks.<BR /> Jose</P> Tue, 01 Mar 2016 14:10:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-inputs-conf-from-a-deployed-app-is-not/m-p/229190#M44584 jacortijo 2016-03-01T14:10:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-inputs-conf-from-a-deployed-app-is-not/m-p/229191#M44585 <P>check </P> <P>the powershell execution policy on the w7 machine<BR /> is the deployment server running windows? if show check file permissions<BR /> try another simple inputs.conf to monitor a file on the desktop (or similar) to check the deployment and client funtionality</P> <P>search <CODE>index=_internal error host=myw7machine</CODE>` to check for app deployment issues</P> <P>as a start....</P> Wed, 02 Mar 2016 02:33:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-inputs-conf-from-a-deployed-app-is-not/m-p/229191#M44585 0YAoNnmRmKDg 2016-03-02T02:33:00Z