splunk forwarder local vs app

[GArienti]

I understand when I install a windows forwarder I end up with MSI.., learned, univforw, serac, etc...

My question is this, if I am just monitoring a couple of things, can I just enter it in the input.conf under etc/local/system instead of under the apps?
What's the difference? why some fields show up in my "learned" props.conf? I didn't put them in there.

I am using windows forwarder to monitor daily logs and event viewers, nothing else, can I ALL my inputs, props and transform under here: C:\Program Files\SplunkUniversalForwarder\etc\system\local
??

[lukejadamec · Accepted solution]

It is generally not a good idea to put your input and other configurations under etc/system/local because that directory cannot be managed with a Deployment Server.

The learned app will be automatically maintained because that is where Splunk puts configurations that were 'learned' automatically by Splunk. One example is an input without a specified sourcetype. If the structure of the log changes, Splunk may create a new sourcetype and place it's definition in the learned app. If you don't want to use the learned sourcetype, then you can override it by specifying the sourcetype explicitly in for that input in inputs.conf.

You can consolidate you inputs, transforms, props config files in a single app. My preference is to create a my own app folder, and manage it with a deployment server. You just need to make sure that you remove all of the conflicting configs that may exist on the system.