Splunk for Unix and Linux controlling inputs

[ylsul]

Hi,

If I want to reduce the number of things reported by the Technical Addon, do I need to edit every inputs.conf file on every server that has a universal forwarder?

Would it be sufficient to edit what is received on the indexer?

[ylsul]

Did you ever get any clarity on this? At the moment, I'm modifying every input.conf on every server I have that uses splunk. It would be nice if we only had to do this on the indexer.

[ylsul]

Thanks. Just to confirm, this means I can just edit the local/inputs.conf on just the indexer, and ignore the inputs.conf on all the other forwarders?

I'm trying to determine the best configuration that keeps the daily volume of stuff indexed under the 500mb quota, so having to edit all the inputs.conf might become problematic. Doing it just on the indexer would make tuning much faster.

[MarioM]

yes you just copy the splunk/etc/apps/Splunk_TA_nix/default/inputs.conf to splunk/etc/apps/Splunk_TA_nix/local folder,edit it and put disabled=true or disabled=1 for each stanza.

As well check you do not have other inputs.conf in splunk/etc/system/local or splunk/etc/apps/any other apps/