https://community.splunk.com/t5/Getting-Data-In/Preferred-placement-of-files-to-be-monitored-which-inputs-conf/m-p/49580#M9406 <P>My indexer is on Linux, but all the forwarders are on Windows. I've been putting the file names being monitored into the inputs.conf file in the MSICreated directories. Thought I should check to see which of the inputs.conf files is considered the "best practices" directory for listing such items.</P> Wed, 27 Jul 2011 19:29:31 GMT RVDowning 2011-07-27T19:29:31Z https://community.splunk.com/t5/Getting-Data-In/Preferred-placement-of-files-to-be-monitored-which-inputs-conf/m-p/49580#M9406 <P>My indexer is on Linux, but all the forwarders are on Windows. I've been putting the file names being monitored into the inputs.conf file in the MSICreated directories. Thought I should check to see which of the inputs.conf files is considered the "best practices" directory for listing such items.</P> Wed, 27 Jul 2011 19:29:31 GMT https://community.splunk.com/t5/Getting-Data-In/Preferred-placement-of-files-to-be-monitored-which-inputs-conf/m-p/49580#M9406 RVDowning 2011-07-27T19:29:31Z https://community.splunk.com/t5/Getting-Data-In/Preferred-placement-of-files-to-be-monitored-which-inputs-conf/m-p/49581#M9407 <P>Not sure there is a best practice with regard to where you 'should' put your particular inputs so long as they work. It is generally less confusing when all configuration is done in a single place so precedence doesn't cause problems. File precedence with conf files that is a very important item to understand. The highest precedence is assigned to conf files located in $SPLUNK_HOME/etc/system/local/.</P> <P><A href="http://www.splunk.com/base/Documentation/latest/admin/Wheretofindtheconfigurationfiles">http://www.splunk.com/base/Documentation/latest/admin/Wheretofindtheconfigurationfiles</A></P> Thu, 28 Jul 2011 22:20:13 GMT https://community.splunk.com/t5/Getting-Data-In/Preferred-placement-of-files-to-be-monitored-which-inputs-conf/m-p/49581#M9407 jbsplunk 2011-07-28T22:20:13Z