Getting Data In

Which inputs.conf do I edit for a universal forwarder on a Domain Controller?

sdorsey
New Member

I am new to Splunk to please excuse the noob question. I could not readily find the answer elsewhere.

In this test environment, I have one Universal Forwarder installed on a Domain Controller. I am wanting to tweak what it sends and know this is done via the inputs.conf file. My question is, which inputs.conf file do I need to edit? Within the Universal Forwarder folder on the host, there are several instances of an inputs.conf file. I do know the one under system/default is where it references default settings if not explicitly listed different elsewhere but I assume it is not best practice to readily edit this one.

Also, I see a mention in the Splunk documentation where you can create an ideal inputs.conf file on the Splunk server itself and push that out to your Universal Forwarders. Could you provide any documentation or a link on how to do this?

0 Karma

ppablo
Retired

Hi @sdorsey

Just following up with this post, but did @chanfoli's answer below help solve your question?

0 Karma

chanfoli
Builder

As a starting point, I would suggest that you create/edit an inputs.conf on your universal forwarder under SPLUNKHOME/etc/system/local/ . The conf files are put into effect according to precedence rules you can learn about here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Wheretofindtheconfigurationfiles

The other option you are talking about is pushing out configs via deployment apps from a deployment server to deployment clients. You can learn about this optional feature here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Aboutdeploymentserver

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...