Solved: Universal Forwarder Inputs Configuration

sjwone · ‎10-23-2013

Version 5.0.5
Windows

I installed the Universal Forwarder on my windows machine using the installation wizard. The forwarder is sending log files to the server correctly. What I'm trying to figure out is where the configuration file containing the directory that is being monitor is stored. I looked in etc/system/local/inputs.conf, but the values were not there. Any other thoughts? I'm puzzled where the forwarder is getting the directory to monitor.

lukejadamec · ‎10-23-2013

If you used the installer, then the input configuation is going to be in Splunk\etc\apps\MSICreated\local\inputs.conf

View solution in original post

lukejadamec · ‎10-23-2013

If you used the installer, then the input configuation is going to be in Splunk\etc\apps\MSICreated\local\inputs.conf

Universal Forwarder Inputs Configuration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

Join the Conversation