Windows Universal Forwarder - initial configuration settings dont seem to be in *.conf

[bbegyperkspot]

When installing a UF on Windows, the installer prompts for sources to forward, including event logs or a path.

I put in a path to some IIS logs but have come to regret my decision. I want to change the values, but I can't find them.

They aren't in

C:\Program Files\SplunkUniversalForwarder\etc\system\local\outputs.conf

or

C:\Program Files\SplunkUniversalForwarder\etc\system\default\outputs.conf

Where are the settings captured during the install and how can I change them?

[bbegyperkspot]

Ok, found it under SplunkTAwindows. So which is the preferred location to declare directories I want monitored?

[somesoni2]

The conf file to look for will be inputs.conf. Search inputs.conf in following locations

C:\Program Files\SplunkUniversalForwarder\etc\system\local
C:\Program Files\SplunkUniversalForwarder\etc\system\default
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local