https://community.splunk.com/t5/Getting-Data-In/Question-about-configuring-the-Master-Node-to-forward-OS-logs/m-p/401934#M71523 <P>I would suggest a manual edit or deployment of *NIX App. Using deployment server.</P> Mon, 04 Nov 2019 17:50:30 GMT yarick 2019-11-04T17:50:30Z https://community.splunk.com/t5/Getting-Data-In/Question-about-configuring-the-Master-Node-to-forward-OS-logs/m-p/401933#M71522 <P>Reading OS logs from a cluster indexer node is controlled by the master node $SPLUNK_HOME/etc/master-apps/_cluster/local/inputs.conf , but that only affects the indexer nodes, not the master node itself.</P> <P>If I configure outputs.conf in $SPLUNK_HOME/etc/system/local/ on the master node, will it then forward everything from the master node or only the monitored paths specified in inputs.conf ?</P> <P>The thing is that I only want to forward OS logs (under /var/log or any other specified file), not the internal stuff from Splunk on the master node itself.</P> Tue, 29 Sep 2020 21:27:22 GMT https://community.splunk.com/t5/Getting-Data-In/Question-about-configuring-the-Master-Node-to-forward-OS-logs/m-p/401933#M71522 nsommars 2020-09-29T21:27:22Z https://community.splunk.com/t5/Getting-Data-In/Question-about-configuring-the-Master-Node-to-forward-OS-logs/m-p/401934#M71523 <P>I would suggest a manual edit or deployment of *NIX App. Using deployment server.</P> Mon, 04 Nov 2019 17:50:30 GMT https://community.splunk.com/t5/Getting-Data-In/Question-about-configuring-the-Master-Node-to-forward-OS-logs/m-p/401934#M71523 yarick 2019-11-04T17:50:30Z