Missing files on Splunk Cloud trial?


Hi, I have been working on configuring a universal forwarder on a free Splunk Cloud trial. I have been using the the link below to setup the forwarder:

There are three files that are missing from the folder specified under Find the configuration files which are:

  • inputs.conf 
  • outputs.conf
  • deploymentclient.conf 

Is that meant to happen in a free Splunk Cloud trial?

Labels (1)
0 Karma


If you only have a single Universal Forwarder (UF) then you don't need deploymentclient.conf.  Worry about that when you have multiple UFs to manage.

The outputs.conf file is provided by Splunk.  Go to the "Universal Forwarder" app on your Splunk Cloud trial instance.  Download the configuration file provided by the app and install it on the UF.  Instructions are in the app.

The UF does come with inputs.conf, but it's not where the docs say it is.  You can find the file in $SPLUNK_HOME/etc/system/default.  DO NOT MODIFY ANY FILES IN THIS DIRECTORY.  Instead, copy the stanza name and the settings you wish to change to $SPLUNK_HOME/etc/system/local and make your changes there.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...