UF inputs.conf stanza

[ITSplunk117]

I'm working on an input.conf from a universal forwarder when I noticed the first stanza is missing a ]

ex:
[WinEventLog://Application instead of [WinEventLog://Application] 

Since I do not have direct access to the UF to check the logs.  What effect, if any, would this have on log ingestion?  

thanks

[gcusello · Accepted solution]

Hi @ITSplunk117,

if you are able to see the Splunk restart on that forwarder you'll see that a configuration error was found.

Anyway, the input stanza isn't running and you haven't those data.

You have two way to solve yur issue:

if you're using a Deployment Server to manage Forwarders, you can correct the error in the app to deploy and deploy it again.

If you aren't using a DS (it isn't a good idea and possible only for little labs uses), you have to manually correct the error accessing the inputs.conf file and after restarting Splunk on the Forwarder.

Ciao.

Giuseppe

Ciao.

Giuseppe