Getting Data In

Which inputs.conf are the inputs stored in when added by web interface

denzelchung
Path Finder

I know that we can manually add data inputs through the inputs.conf file.
I added a file monitoring input via the web interface and wanted to see how it is written in the inputs.conf file. However, I opened the inputs.conf files and could not find any lines related to the file that I am monitoring. Which file is this input stored in?

Tags (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

Don't know from the top of my head, but you can certainly find out using btool:

From $SPLUNK_HOME/bin execute: ./splunk cmd btool inputs list --debug

Assuming you're running on linux, you can search for the relevant lookup by passing it through grep (replace 'foo' with something characteristic for the input you configured): ./splunk cmd btool inputs list --debug | grep foo

View solution in original post

FrankVl
Ultra Champion

Don't know from the top of my head, but you can certainly find out using btool:

From $SPLUNK_HOME/bin execute: ./splunk cmd btool inputs list --debug

Assuming you're running on linux, you can search for the relevant lookup by passing it through grep (replace 'foo' with something characteristic for the input you configured): ./splunk cmd btool inputs list --debug | grep foo

denzelchung
Path Finder

I ran the btool command and it printed out inputs from every inputs.conf file but I do not see the one I added.

Under the web interface, I see it listed under Settings > Data Inputs > Files & Directories

0 Karma

MuS
SplunkTrust
SplunkTrust

Click in the web browser in the URL address field, it will show something like:

 http[s]://hostname:<port>/en-GB/app/YourAppNameHere/....`

you're inputs.conf would be in $SPLUNK_HOME/etc/apps/YourAppNameHere/local

Hope this helps ...

cheers, MuS

0 Karma

denzelchung
Path Finder

Found it! I did not have admin rights to the local folder in the apps directory and so it didn't show up when I used the btool command.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...