Installation

Missing inputs.conf after GPO install

RookieNr1
Observer

Hello all,
I have a problem with which I am currently stuck.
Here is a short explanation.

For the automated installation of the Splunk Forwarder I wanted to perform a customized installation via GPO. Via Orca I have adapted the MSI file and added it to the extra GPO.
The goal is that new servers that join the domain install the forwarder directly at system startup. This works without any problems. The forwarder and the server are shown in the forwarder management. But I can't find the server in the search. It seems that the forwarder does not send any data to the Splunk Enterprise Server.

After comparing the server with a second working one I noticed that the inputs.conf is missing on the new server. For example, as soon as I copy it from a running server and change the corresponding hostname, the Enterprise Server receives data from the new server.

My question now is, why is the file not installed during setup? Is there any possibility that I forgot during the customization via Orca?

I thank you in advance for your answers.

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...