Getting Data In

Can you group configuration files to simplify each app in Splunk (search head, indexer, forwarder)?

Path Finder

Is there any guideline or best practice what .conf to put in gui/indexer/forwarder level?

I mean each .conf has its purpose and a lot of settings, but maybe in practice we can somehow isolate its complexity by grouping the .conf for each level?

Or at least minimize complexity.

Like for example, forwarder usually boils down to at minimum app.conf, inputs.conf, outputs.conf

0 Karma


Hi deodion,
I usually use one TA for outputs.conf and many TAs for different inputs.conf.

0 Karma