Getting Data In
Highlighted

Fowarder default input location

Path Finder

When I install the universal forwarder on a Windows server via the GUI, I have the option to add inputs with check boxes, like Perfmon monitors, Event logs, and folders. However, when I go to: "C:\Program Files\SplunkUniversalForwarder\etc\system\local" I don't see any of those options I've selected previously saved in the configs there.

Where are they saved to and what is the best way to change the options I selected at install?

0 Karma
Highlighted

Re: Fowarder default input location

Motivator
SPLUNK_HOME\etc\apps\MsiCreated

View solution in original post

Highlighted

Re: Fowarder default input location

Path Finder

It was in here:

SPLUNK_HOME\etc\apps\MsiCreated

Thanks!

0 Karma