I have installed another forwarder in Windows 7 machine with default setting and a directory name for monitor log files. after installation Splunk start send data to main instance.
Now question is where is default configuration(monitoring directory path) saved?
You will find the defaults in the different /default/ folders
example on windows : $SPLUNK_HOME\etc\system\default and $SPLUNK_HOME\etc\apps<myapp>\default\
Please read the link from jbsplunk to understand precedence of configurations.
And important advice, NEVER cross the beams.
Ah no, actually it's Never edit a default configuration file, always create a new one in /local/ and add only the specific stanza and parameters to modify.
Thanks for info.
I was looking my initial setup setting during installation.
During installation I provided directory "c:\mylog\" to monitor all files in this directory, now I want to check where this information is saved in Splunk, I didn't find anywhere in Spllunkforwarder*.