Why is there nothing in inputs.conf after Universal Forwarder install, and selecting all the options

[neiljpeterson]

I am just trying to do a quick proof of concept / demo of Spunk.

I installed the Universal Forwarder, and selected all the inputs in the GUI installer, plus selected a directory of log files. After the install my inputs.conf is empty. I could manually add these, but why is the installer not writing my selections to the file? Or am I missing something?

I am running the x64 version in on Windows Server 2008

This is all my inputs.conf has

---

[default]
host = DEV-WEBDEV1

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

---

[neiljpeterson · Accepted solution]

Ok I actually found the correct file.

It was located in

C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local

Is this somewhere in the documentation and I missed it?

Why is there multiple

\etc\local 

folders and multiple input.conf s?

[lukejadamec]

On a Windows box you will find the install created inputs in the splunk\etc\apps\MSICreated\local folder.

[neiljpeterson]

On the host I am forwarding from? I don't see that dir on the host