I created a deployment app, lets call it windows. Inisde Windows\Local\ I have an input.conf and an outputs.conf file. My input.conf file looks like this:
[WinEventLog:Security]
disabled = flase
When the app gets delived to the clients (Windows Universal Forwarders) the input.conf file in the deployed app looks like this:
[WinEventLog://Security]
disabled = 1
What the heck is going on?
You may have a typo, flase
instead of false
.
Nonetheless, the inputs.conf reference suggests 0 or 1 as values. http://docs.splunk.com/Documentation/Splunk/6.1.1/admin/inputsconf
False was spelled wrong, thanks to martin_mueller for pointing that out.
You may have a typo, flase
instead of false
.
Nonetheless, the inputs.conf reference suggests 0 or 1 as values. http://docs.splunk.com/Documentation/Splunk/6.1.1/admin/inputsconf
I'm sure you could build a Splunk alert that tells users to take a break if they've been Splunking along for more than X hours...
That was it... I feel stupid. I think I need to step away from my desk and get some air. Thanks!