Are any default apps in universal forwarder unnecessary?

[hectorvp]

I just installed universal forwarder,

And was deploying my first app using DS, I came accros few apps in place prior to what I configure on UF.

Path: \etc\apps\ 

Apps found are:

introspection_generator_addon

learned

searched

splunk_httpinput

splunk_internal_metrics

SplunkUniversalForwarder

Is any them unnecessary and can I remove?

[richgalloway · Accepted solution]

Any apps already in place before the UF receives anything from the DS is standard Splunk and shouldn't be touched.

[Jagadeesh2022]

Hi @richgalloway 

In my case, more volume of data produced from Learned app. Is there any possibility to disable this app: learned? 

If we can't disable how to stop generate logs from this app: learned ?

Your response is much appreciated. 

Regards,

Jagadeesh

@gcusello @ITWhisperer 

[richgalloway]

This question is more than 2 years old with an accepted answer.  You should have posted a new question.

The learned app is invoked when data is received without a sourcetype.  To avoid using the app, ensure all data ingested by Splunk has a sourcetype associated with it and that sourcetype is configured in props.conf.

[Jagadeesh2022]

@richgalloway 

Sorry to updated in the older question.  

Thanks for your response.  My last question. If we just mention sourcetype in input.conf  is not enough?

I should to mention the same sourcetype again in props.conf ?  

Thanks in advance. 

[richgalloway]

If a sourcetype is not in props.conf then it doesn't exist.  Mentioning it in inputs.conf alone is not enough.  Props.conf is where the properties of the sourcetype are specified.  Without them, Splunk has to guess about the sourcetype and often guesses wrong.