Getting Data In

After making modifications to inputs.conf on a Windows forwarder and restart the splunkforwarder service, why are my changes reversed?

AllenZhang
Explorer

Hi,

I need to make some modifications on an inputs.conf file on a Windows server which is installed with a Splunk Forwarder. After I make the change and save the file, and restart the SplunkForwarder service, the file is changed back and the changes I made are lost.

How can I save the changes?

0 Karma

twinspop
Influencer

Is your forwarder talking to a deployment server? Which copy of inputs.conf are you changing?

If you're on a DS, the DS will override your changes as you describe. Best to talk to your Splunk admin. but if you want to get creative, save a fresh inputs.conf file at $splunkhome\etc\apps\MYCUSTOMAPP\local\inputs.conf and put your changes there. Change MYCUSTOMAPP whatever you want as long as it's unique. The DS will not touch apps it doesn't know about.

0 Karma

AllenZhang
Explorer

The forwarder is talking to deployment server. I can see logs from it. I need to add a particular part of the Application and Services log, [WinEventLog:Microsoft-Windows-...] to the inputs.conf file.

The inputs.conf file is located here: C:\Program Files\SplunkUniversalForwarder\etc\system\local\

I did try stop the Splunkforwarder service first, then make the change, right after I start the service, the inputs.conf file was changed back, my change is lost.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...