Preferred placement of files to be monitored (which inputs.conf)

[RVDowning]

My indexer is on Linux, but all the forwarders are on Windows. I've been putting the file names being monitored into the inputs.conf file in the MSICreated directories. Thought I should check to see which of the inputs.conf files is considered the "best practices" directory for listing such items.

[jbsplunk · Accepted solution]

Not sure there is a best practice with regard to where you 'should' put your particular inputs so long as they work. It is generally less confusing when all configuration is done in a single place so precedence doesn't cause problems. File precedence with conf files that is a very important item to understand. The highest precedence is assigned to conf files located in $SPLUNK_HOME/etc/system/local/.

http://www.splunk.com/base/Documentation/latest/admin/Wheretofindtheconfigurationfiles