All Apps and Add-ons

TA-microsoft-sysmon on Forwarders (UFs) - add a output.conf ?

spunk311z
Path Finder

Im a bit new to deploying forwarders on endpoints i manage (im not new to splunk)-

Many guides i see (including the install instructions for this sysmon TA), state that you should deploy this TA onto your forwarders.

To do this, the user will need to manually create a outputs.conf file (w indexer IP/dns) and place it in: \TA-microsoft-sysmon\default\

So why is there not a default/blank output.conf file located in \TA-microsoft-sysmon\default\ , from the start?
(or even a blank file, with just a #nothing line? I get that the devs dont know the IP / DNS of our indexers).

(im not complaining about this , im asking this incase im missing something and so that i can better understand, as it would seem to me a majority of users of this TA will be deploying it on forwarders as well as their indexer- so im wondering why there is not a outputs.conf "place holder").
thanks!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...