https://community.splunk.com/t5/Getting-Data-In/Custom-inputs-conf-files-in-distributed-architecture/m-p/421282#M74091 <P>Hi @lball,</P> <P>You shall put them in an app and push to the respective servers. If you are using a deployment server to push the configs , then you could use <CODE>serverclass</CODE> to distinguish between the servers [<A href="https://docs.splunk.com/Documentation/Splunk/7.1.1/Updating/Useserverclass.conf">https://docs.splunk.com/Documentation/Splunk/7.1.1/Updating/Useserverclass.conf</A>] . Or you shall put them into the <CODE>local</CODE> directory of splunk to get a higher precedence. Have a look at the following link for more information about config file precedence <A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Wheretofindtheconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Wheretofindtheconfigurationfiles</A></P> Fri, 06 Jul 2018 14:02:24 GMT renjith_nair 2018-07-06T14:02:24Z https://community.splunk.com/t5/Getting-Data-In/Custom-inputs-conf-files-in-distributed-architecture/m-p/421281#M74090 <P>We are using a distributed architecture and I have a couple of servers with custom windows logs that we want to pull into Splunk. I added the needed configs to the inputs.conf file, but periodically the custom inputs.conf files are being overwritten with the universally distributed conf file. How can I prevent this from happening? Or should I just add the custom configs to the core inputs.conf file that gets pushed out to the whole environment?</P> Thu, 05 Jul 2018 16:04:00 GMT https://community.splunk.com/t5/Getting-Data-In/Custom-inputs-conf-files-in-distributed-architecture/m-p/421281#M74090 lball 2018-07-05T16:04:00Z https://community.splunk.com/t5/Getting-Data-In/Custom-inputs-conf-files-in-distributed-architecture/m-p/421282#M74091 <P>Hi @lball,</P> <P>You shall put them in an app and push to the respective servers. If you are using a deployment server to push the configs , then you could use <CODE>serverclass</CODE> to distinguish between the servers [<A href="https://docs.splunk.com/Documentation/Splunk/7.1.1/Updating/Useserverclass.conf">https://docs.splunk.com/Documentation/Splunk/7.1.1/Updating/Useserverclass.conf</A>] . Or you shall put them into the <CODE>local</CODE> directory of splunk to get a higher precedence. Have a look at the following link for more information about config file precedence <A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Wheretofindtheconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Wheretofindtheconfigurationfiles</A></P> Fri, 06 Jul 2018 14:02:24 GMT https://community.splunk.com/t5/Getting-Data-In/Custom-inputs-conf-files-in-distributed-architecture/m-p/421282#M74091 renjith_nair 2018-07-06T14:02:24Z