All Apps and Add-ons

Where default configuration stored?

jangid
Builder

Hi

I have installed another forwarder in Windows 7 machine with default setting and a directory name for monitor log files. after installation Splunk start send data to main instance.

Now question is where is default configuration(monitoring directory path) saved?

Thanks

Tags (1)
0 Karma
1 Solution

jangid
Builder

OK I have figure out this. It stored in MSICreated app.

C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf

Thanks

View solution in original post

0 Karma

jangid
Builder

OK I have figure out this. It stored in MSICreated app.

C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf

Thanks

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

You will find the defaults in the different /default/ folders
example on windows : $SPLUNK_HOME\etc\system\default and $SPLUNK_HOME\etc\apps<myapp>\default\

Please read the link from jbsplunk to understand precedence of configurations.

And important advice, NEVER cross the beams.

Ah no, actually it's Never edit a default configuration file, always create a new one in /local/ and add only the specific stanza and parameters to modify.

jangid
Builder

Thanks for info.
I was looking my initial setup setting during installation.

During installation I provided directory "c:\mylog\" to monitor all files in this directory, now I want to check where this information is saved in Splunk, I didn't find anywhere in Spllunkforwarder*.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

I am not sure I understand your question, but I think a good place to start is here:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Apparchitectureandobjectownership

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!