Getting Data In

After making modifications to inputs.conf on a Windows forwarder and restart the splunkforwarder service, why are my changes reversed?



I need to make some modifications on an inputs.conf file on a Windows server which is installed with a Splunk Forwarder. After I make the change and save the file, and restart the SplunkForwarder service, the file is changed back and the changes I made are lost.

How can I save the changes?

0 Karma


Is your forwarder talking to a deployment server? Which copy of inputs.conf are you changing?

If you're on a DS, the DS will override your changes as you describe. Best to talk to your Splunk admin. but if you want to get creative, save a fresh inputs.conf file at $splunkhome\etc\apps\MYCUSTOMAPP\local\inputs.conf and put your changes there. Change MYCUSTOMAPP whatever you want as long as it's unique. The DS will not touch apps it doesn't know about.

0 Karma


The forwarder is talking to deployment server. I can see logs from it. I need to add a particular part of the Application and Services log, [WinEventLog:Microsoft-Windows-...] to the inputs.conf file.

The inputs.conf file is located here: C:\Program Files\SplunkUniversalForwarder\etc\system\local\

I did try stop the Splunkforwarder service first, then make the change, right after I start the service, the inputs.conf file was changed back, my change is lost.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>