Getting Data In

How do I define a stanza that applies to all stanzas in the same inputs.conf file?

neiljpeterson
Communicator

I could have sworn it was [] but that did not seem to work, nor did [*]

I do not want to use [default] because I don't want to change all inputs on the host, just the ones in a given file.

I could swear I've seen this done, and it should be easy but I searched and searched to no avail.

Please help!

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

This is not the way it works, they are no notion stanza limited to a single inputs.conf or a single app.

The parameter are specific to their specific stanza.
The only exception is the [default] that is for all stanza (in all the apps)

Maybe are you confused with the props.conf that may overlap.

See the way splunk configuration merges, and use btool to verify :

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles
http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

View solution in original post

yannK
Splunk Employee
Splunk Employee

This is not the way it works, they are no notion stanza limited to a single inputs.conf or a single app.

The parameter are specific to their specific stanza.
The only exception is the [default] that is for all stanza (in all the apps)

Maybe are you confused with the props.conf that may overlap.

See the way splunk configuration merges, and use btool to verify :

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles
http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

neiljpeterson
Communicator

Oh. Well then. 😕

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...