Which inputs.conf do I edit for a universal forwarder on a Domain Controller?

[sdorsey]

I am new to Splunk to please excuse the noob question. I could not readily find the answer elsewhere.

In this test environment, I have one Universal Forwarder installed on a Domain Controller. I am wanting to tweak what it sends and know this is done via the inputs.conf file. My question is, which inputs.conf file do I need to edit? Within the Universal Forwarder folder on the host, there are several instances of an inputs.conf file. I do know the one under system/default is where it references default settings if not explicitly listed different elsewhere but I assume it is not best practice to readily edit this one.

Also, I see a mention in the Splunk documentation where you can create an ideal inputs.conf file on the Splunk server itself and push that out to your Universal Forwarders. Could you provide any documentation or a link on how to do this?

[ppablo]

Hi @sdorsey

Just following up with this post, but did @chanfoli's answer below help solve your question?

[chanfoli]

As a starting point, I would suggest that you create/edit an inputs.conf on your universal forwarder under SPLUNKHOME/etc/system/local/ . The conf files are put into effect according to precedence rules you can learn about here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Wheretofindtheconfigurationfiles

The other option you are talking about is pushing out configs via deployment apps from a deployment server to deployment clients. You can learn about this optional feature here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Aboutdeploymentserver