During the Windows forwarder install I specified a path to monitor, and it is working, but it isn't in /splunk_home/etc/system default or local inputs.conf. Where is it? Thanks!
If you added inputs from splunk home then it should be in
If you added inputs from search and reporting app then it should be in
else if you didnt get it still... You should be able to see the inputs by executing below command from splunk CLI.
splunk cmd btool inputs list monitor
Check in $SPLUNK_HOME/etc/apps/app name/default/inputs.conf OR $SPLUNK_HOME/etc/apps/app name/local/inputs.conf
I think app name starts with MSI but I am not sure.