Getting Data In

splunk forwarder local vs app

GArienti
Explorer

I understand when I install a windows forwarder I end up with MSI.., learned, univforw, serac, etc...

My question is this, if I am just monitoring a couple of things, can I just enter it in the input.conf under etc/local/system instead of under the apps?
What's the difference? why some fields show up in my "learned" props.conf? I didn't put them in there.

I am using windows forwarder to monitor daily logs and event viewers, nothing else, can I ALL my inputs, props and transform under here: C:\Program Files\SplunkUniversalForwarder\etc\system\local
??

0 Karma
1 Solution

lukejadamec
Super Champion

It is generally not a good idea to put your input and other configurations under etc/system/local because that directory cannot be managed with a Deployment Server.

The learned app will be automatically maintained because that is where Splunk puts configurations that were 'learned' automatically by Splunk. One example is an input without a specified sourcetype. If the structure of the log changes, Splunk may create a new sourcetype and place it's definition in the learned app. If you don't want to use the learned sourcetype, then you can override it by specifying the sourcetype explicitly in for that input in inputs.conf.

You can consolidate you inputs, transforms, props config files in a single app. My preference is to create a my own app folder, and manage it with a deployment server. You just need to make sure that you remove all of the conflicting configs that may exist on the system.

View solution in original post

lukejadamec
Super Champion

It is generally not a good idea to put your input and other configurations under etc/system/local because that directory cannot be managed with a Deployment Server.

The learned app will be automatically maintained because that is where Splunk puts configurations that were 'learned' automatically by Splunk. One example is an input without a specified sourcetype. If the structure of the log changes, Splunk may create a new sourcetype and place it's definition in the learned app. If you don't want to use the learned sourcetype, then you can override it by specifying the sourcetype explicitly in for that input in inputs.conf.

You can consolidate you inputs, transforms, props config files in a single app. My preference is to create a my own app folder, and manage it with a deployment server. You just need to make sure that you remove all of the conflicting configs that may exist on the system.

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...