Installation

Missing inputs.conf after GPO install

RookieNr1
Observer

Hello all,
I have a problem with which I am currently stuck.
Here is a short explanation.

For the automated installation of the Splunk Forwarder I wanted to perform a customized installation via GPO. Via Orca I have adapted the MSI file and added it to the extra GPO.
The goal is that new servers that join the domain install the forwarder directly at system startup. This works without any problems. The forwarder and the server are shown in the forwarder management. But I can't find the server in the search. It seems that the forwarder does not send any data to the Splunk Enterprise Server.

After comparing the server with a second working one I noticed that the inputs.conf is missing on the new server. For example, as soon as I copy it from a running server and change the corresponding hostname, the Enterprise Server receives data from the new server.

My question now is, why is the file not installed during setup? Is there any possibility that I forgot during the customization via Orca?

I thank you in advance for your answers.

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...