Hi,
I need to make some modifications on an inputs.conf file on a Windows server which is installed with a Splunk Forwarder. After I make the change and save the file, and restart the SplunkForwarder service, the file is changed back and the changes I made are lost.
How can I save the changes?
Is your forwarder talking to a deployment server? Which copy of inputs.conf are you changing?
If you're on a DS, the DS will override your changes as you describe. Best to talk to your Splunk admin. but if you want to get creative, save a fresh inputs.conf
file at $splunkhome\etc\apps\MYCUSTOMAPP\local\inputs.conf
and put your changes there. Change MYCUSTOMAPP whatever you want as long as it's unique. The DS will not touch apps it doesn't know about.
The forwarder is talking to deployment server. I can see logs from it. I need to add a particular part of the Application and Services log, [WinEventLog:Microsoft-Windows-...] to the inputs.conf file.
The inputs.conf file is located here: C:\Program Files\SplunkUniversalForwarder\etc\system\local\
I did try stop the Splunkforwarder service first, then make the change, right after I start the service, the inputs.conf file was changed back, my change is lost.