What is the the purpose of "is_disabled" from opsec.conf and "disabled" from inputs.conf?

[splunkrocks2014]

I am very confused about these two params from Splunk Add-on for Check Point OPSEC LEA Linus:

• "is_disabled" from opsec.conf
• "disabled" from inputs.conf

According to Splunk documentation on page 32, it states that "the inputs.conf disabled state must match the
opsec.conf is_disabled state", the questions are

1. If the connection state is driven by opsec.conf from UI, what is the purpose of “disabled” from inputs.conf?
2. How to maintain both params if they are unable to be auto-sync'ed?
3. I deleted the param, "disabled" from inputs.conf, the UI works perfectly. Is "disabled" required in inputs.conf?

Thanks.

[jcoates_splunk]

hi, I think that the inputs.conf disabled is the really important one, without that set to disabled you will continue to get data into Splunk.