Why are outputs.conf not found?

[HaakonRuud]

I've made an app and put the app in "$Splunk_Home\etc\apps\app_name\local" where I have the outputs.conf file. Since there is no outputs.conf file in "$Splunk_Home\etc\system\local" I get an error message in the log stating: "LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf".  If I move the outputs.conf file from my app to "$Splunk_Home\etc\system\local" it will work. I've have already an old setup that I inherited where this is working. It seems like the file in my app is not read for some reason. I've checked that the user have read access to files in my app. Unfortunatly I don't have documentation from the old setup so I can't see how this was implemented. Are someone able to point me in the right direction? I've tried searching for this issue, but couldn't find anything related to this issue. Thanks in advance

[HaakonRuud]

I've checked that there is only outputs.conf files in $Splunk_Home\etc\apps\SplunkUniversalForwarder\default, $Splunk_Home\ets\system\default and in $Splunk_Home\etc\apps\app_name\local

[isoutamo]

Hi

just try to run

splunk btool outputs list —debug

to see where splunk found that file and what  parameters it get for it. 

r. Ismo

[HaakonRuud]

Hi

After running "splunk btool outputs list --debug" it finds all the outputs.conf files except the one that's in the app I created. I've checked the folder and files and it has exactly the same read permitions as the $Splunk_Home\etc\system folder. Do you have any sugestions what this means? Thank you so far!

[gcusello]

Hi @HaakonRuud,

at first $Splunk_Home\etc\apps\SplunkUniversalForwarder\default, isn't relevant: this is an internal app to not use.

Anyway, outputs.conf must be located in $SPLUNK_HOME\etc\system\local or in $SPLUNK_HOME\etc\apps\your_app\local.

The approach to put outputs.conf in a dedicated app is a best practice that I always use, so it must run.

If not, check if the user used to run Splunk has the rights to read this file.

then, please share it, maybe there's an erro so it isn't read by Splunk.

And always remember to restart Forwarder.

Ciao.

Giuseppe