Getting Data In

Why are outputs.conf not found?

HaakonRuud
Explorer

I've made an app and put the app in "$Splunk_Home\etc\apps\app_name\local" where I have the outputs.conf file. Since there is no outputs.conf file in "$Splunk_Home\etc\system\local" I get an error message in the log stating: "LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf".  If I move the outputs.conf file from my app to "$Splunk_Home\etc\system\local" it will work. I've have already an old setup that I inherited where this is working. It seems like the file in my app is not read for some reason. I've checked that the user have read access to files in my app. Unfortunatly I don't have documentation from the old setup so I can't see how this was implemented. Are someone able to point me in the right direction? I've tried searching for this issue, but couldn't find anything related to this issue. Thanks in advance

Labels (1)
0 Karma

HaakonRuud
Explorer

I've checked that there is only outputs.conf files in $Splunk_Home\etc\apps\SplunkUniversalForwarder\default, $Splunk_Home\ets\system\default and in $Splunk_Home\etc\apps\app_name\local

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

just try to run

splunk btool outputs list —debug

to see where splunk found that file and what  parameters it get for it. 

r. Ismo

0 Karma

HaakonRuud
Explorer

Hi

After running "splunk btool outputs list --debug" it finds all the outputs.conf files except the one that's in the app I created. I've checked the folder and files and it has exactly the same read permitions as the $Splunk_Home\etc\system folder. Do you have any sugestions what this means? Thank you so far!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @HaakonRuud,

at first $Splunk_Home\etc\apps\SplunkUniversalForwarder\default, isn't relevant: this is an internal app to not use.

Anyway, outputs.conf must be located in $SPLUNK_HOME\etc\system\local or in $SPLUNK_HOME\etc\apps\your_app\local.

The approach to put outputs.conf in a dedicated app is a best practice that I always use, so it must run.

If not, check if the user used to run Splunk has the rights to read this file.

then, please share it, maybe there's an erro so it isn't read by Splunk.

And always remember to restart Forwarder.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...