Missing inputs.conf after GPO install


Hello all,
I have a problem with which I am currently stuck.
Here is a short explanation.

For the automated installation of the Splunk Forwarder I wanted to perform a customized installation via GPO. Via Orca I have adapted the MSI file and added it to the extra GPO.
The goal is that new servers that join the domain install the forwarder directly at system startup. This works without any problems. The forwarder and the server are shown in the forwarder management. But I can't find the server in the search. It seems that the forwarder does not send any data to the Splunk Enterprise Server.

After comparing the server with a second working one I noticed that the inputs.conf is missing on the new server. For example, as soon as I copy it from a running server and change the corresponding hostname, the Enterprise Server receives data from the new server.

My question now is, why is the file not installed during setup? Is there any possibility that I forgot during the customization via Orca?

I thank you in advance for your answers.

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...