Getting Data In

Splunk forwarder config not working

amitj
New Member

since are trying to separate out splunk forwarder config ("inputs.conf") according to indexer. we defined forwarder conf like "/opt/splunkforwarder/etc/apps/IND1/inputs.conf", "/opt/splunkforwarder/etc/apps/IND2/inputs.conf" and restarted the splunk instance. but somehow it is not working..Do I need to define "IND1" and "IND2" as an app first?

Tags (1)
0 Karma

amitj
New Member

No, do I need to define outputs.conf for this?

0 Karma

jtworzydlo
Path Finder

Have you also defined outputs.conf for each config?

0 Karma

amitj
New Member

yes, I added to "local" directory like../opt/splunkforwarder/etc/apps/IND1/local/inputs.conf but it didn't work

0 Karma

Ayn
Legend

inputs.conf, like all other configuration files, need to be either in an app's default directory or its local directory. So, /opt/splunkforwarder/etc/apps/IND1/default/inputs.conf would work, for instance.

0 Karma

Ayn
Legend

OK, because that's not what it said in your question...anyhow, you shouldn't need to "activate" this anywhere, just restart the Splunk instance and you should be good to go. Possible steps forward is to check btool output ($SPLUNK_HOME/bin/splunk cmd btool inputs list --debug) to see if Splunk sees your defined inputs. If it does, you should check splunkd.log to see if there are any problems with the inputs you've defined.

0 Karma

amitj
New Member

yes, I added to "local" directory like../opt/splunkforwarder/etc/apps/IND1/local/inputs.conf but it didn't work

0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...