Hi
I have installed another forwarder in Windows 7 machine with default setting and a directory name for monitor log files. after installation Splunk start send data to main instance.
Now question is where is default configuration(monitoring directory path) saved?
Thanks
OK I have figure out this. It stored in MSICreated app.
C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf
Thanks
OK I have figure out this. It stored in MSICreated app.
C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf
Thanks
You will find the defaults in the different /default/ folders
example on windows : $SPLUNK_HOME\etc\system\default and $SPLUNK_HOME\etc\apps<myapp>\default\
Please read the link from jbsplunk to understand precedence of configurations.
And important advice, NEVER cross the beams.
Ah no, actually it's Never edit a default configuration file, always create a new one in /local/ and add only the specific stanza and parameters to modify.
Thanks for info.
I was looking my initial setup setting during installation.
During installation I provided directory "c:\mylog\" to monitor all files in this directory, now I want to check where this information is saved in Splunk, I didn't find anywhere in Spllunkforwarder*.
I am not sure I understand your question, but I think a good place to start is here:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Apparchitectureandobjectownership