Where default configuration stored?

[jangid]

Hi

I have installed another forwarder in Windows 7 machine with default setting and a directory name for monitor log files. after installation Splunk start send data to main instance.

Now question is where is default configuration(monitoring directory path) saved?

Thanks

[jangid · Accepted solution]

OK I have figure out this. It stored in MSICreated app.

C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf

Thanks

[yannK]

You will find the defaults in the different /default/ folders
example on windows : $SPLUNK_HOME\etc\system\default and $SPLUNK_HOME\etc\apps<myapp>\default\

Please read the link from jbsplunk to understand precedence of configurations.

And important advice, NEVER cross the beams.

Ah no, actually it's Never edit a default configuration file, always create a new one in /local/ and add only the specific stanza and parameters to modify.

[jangid]

Thanks for info.
I was looking my initial setup setting during installation.

During installation I provided directory "c:\mylog\" to monitor all files in this directory, now I want to check where this information is saved in Splunk, I didn't find anywhere in Spllunkforwarder*.

[jbsplunk]

I am not sure I understand your question, but I think a good place to start is here:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Apparchitectureandobjectownership