Archive

Where default configuration stored?

Builder

Hi

I have installed another forwarder in Windows 7 machine with default setting and a directory name for monitor log files. after installation Splunk start send data to main instance.

Now question is where is default configuration(monitoring directory path) saved?

Thanks

Tags (1)
0 Karma
1 Solution

Builder

OK I have figure out this. It stored in MSICreated app.

C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf

Thanks

View solution in original post

0 Karma

Builder

OK I have figure out this. It stored in MSICreated app.

C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf

Thanks

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

You will find the defaults in the different /default/ folders
example on windows : $SPLUNK_HOME\etc\system\default and $SPLUNK_HOME\etc\apps<myapp>\default\

Please read the link from jbsplunk to understand precedence of configurations.

And important advice, NEVER cross the beams.

Ah no, actually it's Never edit a default configuration file, always create a new one in /local/ and add only the specific stanza and parameters to modify.

Builder

Thanks for info.
I was looking my initial setup setting during installation.

During installation I provided directory "c:\mylog\" to monitor all files in this directory, now I want to check where this information is saved in Splunk, I didn't find anywhere in Spllunkforwarder*.

0 Karma

Splunk Employee
Splunk Employee

I am not sure I understand your question, but I think a good place to start is here:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Apparchitectureandobjectownership

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!