topic Re: Which inputs.conf are the inputs stored in when added by web interface in Getting Data In

Which inputs.conf are the inputs stored in when added by web interface

denzelchung — Wed, 26 Jun 2019 09:00:29 GMT

I know that we can manually add data inputs through the inputs.conf file.
I added a file monitoring input via the web interface and wanted to see how it is written in the inputs.conf file. However, I opened the inputs.conf files and could not find any lines related to the file that I am monitoring. Which file is this input stored in?

Re: Which inputs.conf are the inputs stored in when added by web interface

FrankVl — Wed, 26 Jun 2019 10:19:01 GMT

Don't know from the top of my head, but you can certainly find out using btool:

From $SPLUNK_HOME/bin execute: ./splunk cmd btool inputs list --debug

Assuming you're running on linux, you can search for the relevant lookup by passing it through grep (replace 'foo' with something characteristic for the input you configured): ./splunk cmd btool inputs list --debug | grep foo

Re: Which inputs.conf are the inputs stored in when added by web interface

denzelchung — Thu, 27 Jun 2019 00:57:30 GMT

I ran the btool command and it printed out inputs from every inputs.conf file but I do not see the one I added.

Under the web interface, I see it listed under Settings > Data Inputs > Files & Directories

Re: Which inputs.conf are the inputs stored in when added by web interface

MuS — Thu, 27 Jun 2019 01:12:56 GMT

Click in the web browser in the URL address field, it will show something like:

 http[s]://hostname:<port>/en-GB/app/YourAppNameHere/....`

you're inputs.conf would be in $SPLUNK_HOME/etc/apps/YourAppNameHere/local

Hope this helps ...

cheers, MuS

Re: Which inputs.conf are the inputs stored in when added by web interface

denzelchung — Thu, 27 Jun 2019 02:34:30 GMT

Found it! I did not have admin rights to the local folder in the apps directory and so it didn't show up when I used the btool command.