I am just trying to do a quick proof of concept / demo of Spunk.
I installed the Universal Forwarder, and selected all the inputs in the GUI installer, plus selected a directory of log files. After the install my inputs.conf is empty. I could manually add these, but why is the installer not writing my selections to the file? Or am I missing something?
I am running the x64 version in on Windows Server 2008
This is all my inputs.conf has
[default]
host = DEV-WEBDEV1
[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0
Ok I actually found the correct file.
It was located in
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local
Is this somewhere in the documentation and I missed it?
Why is there multiple
\etc\local
folders and multiple input.conf s?
Ok I actually found the correct file.
It was located in
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local
Is this somewhere in the documentation and I missed it?
Why is there multiple
\etc\local
folders and multiple input.conf s?
On a Windows box you will find the install created inputs in the splunk\etc\apps\MSICreated\local folder.
On the host I am forwarding from? I don't see that dir on the host