topic Re: uf install didn't create inputs.conf in Getting Data In

uf install didn't create inputs.conf

a212830 — Mon, 13 May 2013 15:15:43 GMT

Hi,

I installed a UF on a windows server, and asked it to monitor Forwarding Events, but I don't see anything create in inputs.conf. Is it stored anywhere?

Re: uf install didn't create inputs.conf

yannK — Mon, 13 May 2013 15:25:42 GMT

What are "forwarding events" , is it a WinEventLog channel ?

inputs.conf can be in many locations.

$SPLUNK_HOME/etc/system/local
$SPLUNK_HOME/etc/apps/search/local
$SPLUNK_HOME/etc/apps/MSI-created/local
$SPLUNK_HOME/etc/apps//local
etc...

Re: uf install didn't create inputs.conf

a212830 — Mon, 13 May 2013 15:27:23 GMT

When you install the forwarder, the gui asks if you want to monitor certain files, and that's one of them.

Re: uf install didn't create inputs.conf

a212830 — Mon, 13 May 2013 15:28:26 GMT

Just found it - MSI.... Thanks.

Re: uf install didn't create inputs.conf

wildbird — Tue, 06 Apr 2021 06:24:44 GMT

I have a similar issue, I have created an app distributed it to my windows server2016 and only the app.conf appears on the server after deployment

steps I did:

created an app with inputs.conf file in my deployment server (/opt/splunk/etc/deployment-apps/my_app/local/inputs.conf)
created a relevant server class
Attached my app to the server class
Made sure that my server is in the include list of the sever class.
splunk apply shcluster-bundle --target https://SH:8089 --answer-yes.
RDP to server - the directory been created but only app.conf
I have tried to troubleshoot by deleting the local copy of the app on the server and disabled any security policy on that server and rerun step 5 - with the same result.

please advise

Re: uf install didn't create inputs.conf

scelikok — Tue, 06 Apr 2021 06:39:59 GMT

Hİ @wildbird,

splunk apply shcluster-bundle --target https://SH:8089 --answer-yes

Ths command is not for deployment server, you should use below instead;

splunk reload deploy-server

Re: uf install didn't create inputs.conf

wildbird — Tue, 06 Apr 2021 06:47:56 GMT

Hi @scelikok

it's solved my issue!

Thank you very much!

can you please help me understand what I did wrong?

when do I use: Splunk apply shcluster-bundle and when to use splunk reload deploy-server?

Re: uf install didn't create inputs.conf

scelikok — Tue, 06 Apr 2021 08:52:00 GMT

Hi @wildbird,

Great 😊

"splunk apply shcluster-bundle" command is for Deployer to push the apps from $SPLUNK_HOME/etc/shcluster/apps to Search Head Cluster members.

https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/PropagateSHCconfigurationchanges

"splunk reload deploy-server" command is for Deployment Server to update Deployment server apps/serverclass bundles hashes on $SPLUNK_HOME/etc/deployment-apps folder. Deployment clients like Universal Forwarders will get the new apps on their next requests.

https://docs.splunk.com/Documentation/Splunk/8.1.3/Updating/Updateconfigurations

Sometimes it is confusing since both commands is related to Deploy 😀