Getting Data In

Why is there nothing in inputs.conf after Universal Forwarder install, and selecting all the options

neiljpeterson
Communicator

I am just trying to do a quick proof of concept / demo of Spunk.

I installed the Universal Forwarder, and selected all the inputs in the GUI installer, plus selected a directory of log files. After the install my inputs.conf is empty. I could manually add these, but why is the installer not writing my selections to the file? Or am I missing something?

I am running the x64 version in on Windows Server 2008

This is all my inputs.conf has


[default]
host = DEV-WEBDEV1

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

0 Karma
1 Solution

neiljpeterson
Communicator

Ok I actually found the correct file.

It was located in

C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local

Is this somewhere in the documentation and I missed it?

Why is there multiple

\etc\local 

folders and multiple input.conf s?

View solution in original post

0 Karma

neiljpeterson
Communicator

Ok I actually found the correct file.

It was located in

C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local

Is this somewhere in the documentation and I missed it?

Why is there multiple

\etc\local 

folders and multiple input.conf s?

0 Karma

lukejadamec
Super Champion

On a Windows box you will find the install created inputs in the splunk\etc\apps\MSICreated\local folder.

0 Karma

neiljpeterson
Communicator

On the host I am forwarding from? I don't see that dir on the host

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...