Which inputs.conf are the inputs stored in when added by web interface

[denzelchung]

I know that we can manually add data inputs through the inputs.conf file.
I added a file monitoring input via the web interface and wanted to see how it is written in the inputs.conf file. However, I opened the inputs.conf files and could not find any lines related to the file that I am monitoring. Which file is this input stored in?

[FrankVl · Accepted solution]

Don't know from the top of my head, but you can certainly find out using btool:

From $SPLUNK_HOME/bin execute: ./splunk cmd btool inputs list --debug

Assuming you're running on linux, you can search for the relevant lookup by passing it through grep (replace 'foo' with something characteristic for the input you configured): ./splunk cmd btool inputs list --debug | grep foo

[denzelchung]

I ran the btool command and it printed out inputs from every inputs.conf file but I do not see the one I added.

Under the web interface, I see it listed under Settings > Data Inputs > Files & Directories

[MuS]

Click in the web browser in the URL address field, it will show something like:

 http[s]://hostname:<port>/en-GB/app/YourAppNameHere/....`

you're inputs.conf would be in $SPLUNK_HOME/etc/apps/YourAppNameHere/local

Hope this helps ...

cheers, MuS

[denzelchung]

Found it! I did not have admin rights to the local folder in the apps directory and so it didn't show up when I used the btool command.