How to configure inputs.conf monitoring on universal forwarders for multiple apps?

[yanivamram]

Hi,

I'm using a Splunk Universal Forwarder to monitor log files on various machines.
I would like to split the inputs.conf in a way that each of my applications will "contribute" its own inputs.conf file.

Like:
<Splunk Home>/etc/apps/<my app1>/local/inputs.conf
and
/etc/apps/<my app2>/local/inputs.conf

The problem is that, although I see the forwarder monitor my log files, I don't see it on the Splunk server 😞
I do see data from other monitored log files which are configured in <Splunk Home>/etc/apps/search/local/inputs.conf

What am I doing wrong?

Thanks in advance,

Yaniv

[jensonthottian]

did you check your default folder for each app.

[tskinnerivsec]

you can use the btool command to see which inputs.conf directives are applied on your Universal forwarder:

splunk btool list inputs

This will show you what stanzas from inputs.conf are currently being applied. To give more help, we would need to see a sample of the inputs.conf file that is working, along with the path to the conf file as well as the same information from one of your inputs.conf files that is not working as expected.