Getting Data In

Universal Forwarder Inputs Configuration

sjwone
Explorer

Version 5.0.5
Windows

I installed the Universal Forwarder on my windows machine using the installation wizard. The forwarder is sending log files to the server correctly. What I'm trying to figure out is where the configuration file containing the directory that is being monitor is stored. I looked in etc/system/local/inputs.conf, but the values were not there. Any other thoughts? I'm puzzled where the forwarder is getting the directory to monitor.

Tags (1)
0 Karma
1 Solution

lukejadamec
Super Champion

If you used the installer, then the input configuation is going to be in Splunk\etc\apps\MSICreated\local\inputs.conf

View solution in original post

lukejadamec
Super Champion

If you used the installer, then the input configuation is going to be in Splunk\etc\apps\MSICreated\local\inputs.conf

Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...