Splunk Enterprise

Can i tweak log.cfg so that splunkd.log contains inputs.conf?

sfmandmdev
Path Finder

I would like to see my list of directories from inputs.conf show up in splunkd.log. It there any attribute value that I can add/tweak from log.cfg in splunk to do that?

0 Karma

Genti
Splunk Employee
Splunk Employee

Well, splunkd.log contains internal logs about what splunk is doing.
inputs.conf contains your list of monitored files, directories, and othe tcp/udp inputs.

As such, splunkd.log cannot contain the file itself. However it does contain information on what is going on with those inputs, for example, it logs when a file is found in a monitored path, when it gets indexed etc.

What exactly are you trying to achieve? Is it a list of all your inputs? if so, try:

./splunk list monitor

or

./splunk cmd btool inputs list --debug

UPDATE
I didn't mention any forwarders, not sure where you got that from...
If all you want to do is see inputs.conf within splunk then add a splunk monitor stanza that contains them, like:

[monitor://<path to your splunk>/etc/.../inputs.conf]

or, you can run the above two commands and write them (pipe) to a file which you then monitor.

Genti
Splunk Employee
Splunk Employee

see updated answer above.

0 Karma

sfmandmdev
Path Finder

I don't want to give my splunk user access to splunk forwarder. I want to be able to see it in the internal logs itself, so that I can search on them via splunk UI- Can splunkd.log contain the list of monitored directories ?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...