Brand new to Splunk. Installed the universal forwarder on a Windows Server and see the logs populating on my Splunk Light server. I want to re-configure the forwarder to not include performance monitoring (which I selected on install.)
Where is the conf file that I need to edit? I see documentation that points to conf files located here:
But I don't see any data relating to which logs and performance monitoring is being forwarded here.
Thanks. This looks like exactly what I need. Before I posted this I did numerous searches for this info and couldn't find it. There was plenty of very confusing info about conf file precedence though! Any links that explain the configuration of the forwarder in simple examples would also be appreciated.