topic Lightweight Universal Forwarder - Reconfigure in Getting Data In

Lightweight Universal Forwarder - Reconfigure

kevind5 — Tue, 27 Nov 2012 21:27:47 GMT

This app was originally installed to forward all Win Evernt Logs to my Splunk server. I want to change this. Do I have to reinstall the software or is there a .conf file that I can update.

Thanks

Re: Lightweight Universal Forwarder - Reconfigure

yannK — Mon, 28 Sep 2020 12:52:43 GMT

look for the inputs.conf and wmi.conf etc... in the local folders.
and add disabled=true

see in $SPLUNK_HOME\etc\app\\local
and $SPLUNK_HOME\etc\system\local

for details : http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Inputsconf