topic Re: default '/opt/splunk/etc/deployment-apps/Splunk_TA_windows/local/inputs.conf'? in Getting Data In

default '/opt/splunk/etc/deployment-apps/Splunk_TA_windows/local/inputs.conf'?

mitag — Fri, 10 Jul 2020 20:03:34 GMT

tl;dr: what are the initial, default contents of /opt/splunk/etc/deployment-apps/Splunk_TA_windows/local/inputs.conf as it ships with "Splunk_TA_windows" - if it exists and not empty?

Reason I ask: it does not exist in my instance on the Deployment Server (only apps.conf in that folder); I am trying to figure out what it should be and how to fix what seems to be a broken "Splunk Add-on for Microsoft Windows" ("Splunk_TA_windows") in an inherited Splunk instance. The TA doesn't seem to be gathering any data, and produces errors such:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winhostinfo.exe"" splunk-winhostinfo - Found a invalid type named 'application' in stanza WinHostMon://Application, this will not be processed.

(i.e. the TA can't find the executables or scripts it needs.)

I suspect this is due to someone merging the TA's own inputs.conf into a single master inputs.conf (/opt/splunk/etc/deployment-apps/_server_app_Windows_Clients/local/inputs.conf on the Deployment Server) and then deleting it - which seems to have broken things.

Thanks!

P.S. Apologies for the formatting - for some reason "Insert/Edit code sample" buttons don't work for me.

Re: default '/opt/splunk/etc/deployment-apps/Splunk_TA_windows/local/inputs.conf'?

richgalloway — Sat, 11 Jul 2020 00:31:34 GMT

Most apps ship with an empty local directory, except for app.conf.
If your app is broken, re-install it.

The code button on this forum is non-intuitive. You must click the button with no text highlighted then enter your code into the pop-up box.

Re: default '/opt/splunk/etc/deployment-apps/Splunk_TA_windows/local/inputs.conf'?

mitag — Sun, 12 Jul 2020 01:14:19 GMT

Thank you, this was the answer:

"Most apps ship with an empty local directory, except for app.conf."

It's also implied in "Download and configure the Splunk Add-on for Windows version 6.0.0 or later":

"Copy the inputs.conf file in the default subdirectory to the local directory.<"

P.S. The app may not be broken after all - just unconfigured. Likely the "_server_app_Windows_Clients" needs to be cleaned up - cleared of things that were originally part of the add-on. (Don't ask. That person has left the building.)

P.P.S. What's the accepted format for quotes? E.g. quoting documentation or snippets from others' posts?

Re: default '/opt/splunk/etc/deployment-apps/Splunk_TA_windows/local/inputs.conf'?

richgalloway — Sun, 12 Jul 2020 17:10:29 GMT

P.P.S. What's the accepted format for quotes? E.g. quoting documentation or snippets from others' posts?

We don't have one, yet.