Getting Data In

Where is the Inputs.conf file located?

cramery
New Member

Im new to Splunk so this question may seem a bit low level, but I couldn't find anything helpful.

I read several tutorials for using Splunk, where all of them add Infos to the inputs.conf file. It looks like there must be a directory in my Splunk-folder on my computer, but Splunk Light on my PC only is a reference so it can be opened on localhost in a browser, where it gets opened, so no other directories. also in the Splunk-terminal there I coudn't find the Inputs.conf file. Where are these kind of Files located?

0 Karma

woodcock
Esteemed Legend

Generally, you create an app and put inputs.conf there, like this: $SPLUNK_HOME/etc/apps/YourAppNameHere/default/inputs.conf. Yes, it is that easy. Do not get into the HORRIBLE habit of using the GUI to create inputs because then they will be placed in various places and also in the local (instead of the correct default) directory. Also, you should be using a Deployment Serer to deploy these apps to your forwarders. In that case, put your app in the deployment-apps directory here: $SPLUNK_HOME/etc/deployment-apps/YourAppNameHere/default/inputs.conf. Then have your forwarders pull it in as Deployment Clients and it will end up in the apps directory on the client.

woodcock
Esteemed Legend

If you have a working inputs.conf "somewhere", you can locate it like this:

$SPLUNK_HOME/bin/splunk btool inputs list --debug

nickhills
Ultra Champion

Hi @cramery
Take a look at this article:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles

inputs.conf can exist in a number of places, but given that you have just installed Splunk Light, I presume you are just using your local machine, standalone.

In this case look in $SPLUNK_HOME
(/opt/splunk on linux, c:\program files\splunk on windows)

Under that path look in:
$SPLUNK_HOME/etc/apps/search/local

If this is a new install, you may not yet have an inputs.conf, but this is a good place to create one.

If you have already configured some inputs they may have been added to
$SPLUNK_HOME/etc/apps/launcher/local/inputs.conf

If my comment helps, please give it a thumbs up!
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...