Getting Data In

splunk forwarder local vs app

GArienti
Explorer

I understand when I install a windows forwarder I end up with MSI.., learned, univforw, serac, etc...

My question is this, if I am just monitoring a couple of things, can I just enter it in the input.conf under etc/local/system instead of under the apps?
What's the difference? why some fields show up in my "learned" props.conf? I didn't put them in there.

I am using windows forwarder to monitor daily logs and event viewers, nothing else, can I ALL my inputs, props and transform under here: C:\Program Files\SplunkUniversalForwarder\etc\system\local
??

0 Karma
1 Solution

lukejadamec
Super Champion

It is generally not a good idea to put your input and other configurations under etc/system/local because that directory cannot be managed with a Deployment Server.

The learned app will be automatically maintained because that is where Splunk puts configurations that were 'learned' automatically by Splunk. One example is an input without a specified sourcetype. If the structure of the log changes, Splunk may create a new sourcetype and place it's definition in the learned app. If you don't want to use the learned sourcetype, then you can override it by specifying the sourcetype explicitly in for that input in inputs.conf.

You can consolidate you inputs, transforms, props config files in a single app. My preference is to create a my own app folder, and manage it with a deployment server. You just need to make sure that you remove all of the conflicting configs that may exist on the system.

View solution in original post

lukejadamec
Super Champion

It is generally not a good idea to put your input and other configurations under etc/system/local because that directory cannot be managed with a Deployment Server.

The learned app will be automatically maintained because that is where Splunk puts configurations that were 'learned' automatically by Splunk. One example is an input without a specified sourcetype. If the structure of the log changes, Splunk may create a new sourcetype and place it's definition in the learned app. If you don't want to use the learned sourcetype, then you can override it by specifying the sourcetype explicitly in for that input in inputs.conf.

You can consolidate you inputs, transforms, props config files in a single app. My preference is to create a my own app folder, and manage it with a deployment server. You just need to make sure that you remove all of the conflicting configs that may exist on the system.

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...