Getting Data In

Remove Universal Forwarder default monitoring sources

ajmorris
Engager

I've just installed the Universal Forwarder on Windows using the MSI. During installation, I told it to only monitor one folder of logs. It did that, and it's monitoring all of the windows events, too. That's causing me to exceed my license. I would like to turn off all of the default logging sources, except for the one I selected.

Reading everything I can find, I would expect that those would be listed in the Forwarder's inputs.conf, but there's nothing in there for my folder or for the Windows events. So, where are the settings that I entered using the MSI? And, how do I change them? And, how do I dial down the forwarding to just the one folder that I want?

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Those configurations must reside on an inputs.conf file, these files can be located in multiples locations:

etc/system/local and default
etc/any app/local and default
Users folders...

Anyway if you are not able to found it, you can use this command:

splunk cmd btool inputs list --debug

regards

View solution in original post

gfuente
Motivator

Those configurations must reside on an inputs.conf file, these files can be located in multiples locations:

etc/system/local and default
etc/any app/local and default
Users folders...

Anyway if you are not able to found it, you can use this command:

splunk cmd btool inputs list --debug

regards

ajmorris
Engager

Wow, that was exactly what I needed. It took me a minute to figure out that I need to run that at an admin command prompt, though. The event log monitors were defined in:
\etc\apps\Splunk_TA_windows\default\inputs.conf
Now that I see the TA folder, I understand that it's the Windows Technology Add-On, and it all makes a lot more sense. Thanks you!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...