Deployment Architecture

Deployment Server App Confusion

knutsod
Path Finder

I created a deployment app, lets call it windows. Inisde Windows\Local\ I have an input.conf and an outputs.conf file. My input.conf file looks like this:

[WinEventLog:Security]
disabled = flase

When the app gets delived to the clients (Windows Universal Forwarders) the input.conf file in the deployed app looks like this:

[WinEventLog://Security]
disabled = 1

What the heck is going on?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You may have a typo, flase instead of false.

Nonetheless, the inputs.conf reference suggests 0 or 1 as values. http://docs.splunk.com/Documentation/Splunk/6.1.1/admin/inputsconf

View solution in original post

knutsod
Path Finder

False was spelled wrong, thanks to martin_mueller for pointing that out.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You may have a typo, flase instead of false.

Nonetheless, the inputs.conf reference suggests 0 or 1 as values. http://docs.splunk.com/Documentation/Splunk/6.1.1/admin/inputsconf

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I'm sure you could build a Splunk alert that tells users to take a break if they've been Splunking along for more than X hours...

0 Karma

knutsod
Path Finder

That was it... I feel stupid. I think I need to step away from my desk and get some air. Thanks!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!