I am looking through my list of Data inputs (files) and notice some have an app of Search, while others have an app of launcher. What is the difference between these two apps and does it really matter which one is being used?
It's very easy to accidentally save things into Launcher app when you probably intended to save them into the Search app. In the particular case of data inputs though, it doesn't really matter because inputs take effect at the system level anyway.
However if some inputs ended up in Launcher, you may find that you've saved some other entities like saved searches into the Launcher app by mistake. If so it's good to clean these mistakes up sooner rather than later before they cause confusion.
In short, Every configuration change in splunk maps to some key(s) in some stanza in some configuration file. However the files are interpreted in a layered fashion and this is where things get complicated. See here for more details:: http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles
This means that a particular data input, or an eventtype or a regex or whatever, might be in the system directories, or it might be in an app context, meaning it's in the directories within that app. Beyond that granularity, for some entities like 'viewstates' and 'savedsearches', it can even be over in a user layer, within an app layer, like /etc/users/
And on the other extreme like for inputs.conf and many keys in props.conf (possibly all im not sure), the app context doesn't actually affect it's functionality at all; the changes take effect at a system level even if the file happens to be inside some app directory...
I hope this helps.
It's about as clear as the rest of the Splunk documentation. 😛 So my assumption is remake those inputs using search and only have them follow the file tail to avoid duplicating data.
If you add an input, Splunk adds that input to a copy of inputs.conf that belongs to the app you're in when you add that input. This means that if you navigated to Splunk Manager, directly from the Launcher your input will be added to $SPLUNK_HOME/etc/apps/launcher/local/inputs.conf.