Splunk Dev

Where is my monitor stanza?

aanataliya
Explorer

I have added monitoring with below command on my windows client.

./splunk add monitor C:\path\to.log -index qa -sourcetype pcs_log -host <ip>

I can see above path in monitored file list when I execute splunk list monitor.

As per my understanding splunk add monitor adds below stanza in inputs.conf. Isn't it? But I am unable to find these lines in any of inputs.conf file. I have checked /etc/system/local/inputs.conf but it doesnt have these values.

[monitor://path/to.log]
disabled = 0
setting1 = value
setting2 = value
...

I am using splunk cloud and installed universal forwarder. can you please help?

Tags (1)
0 Karma

aivarson_splunk
Splunk Employee
Splunk Employee

When you add a monitor from the CLI it goes to the search app, local, inputs config. $SPLUNK_HOME\etc\apps\search\local\inputs.conf

0 Karma

renjith_nair
Legend

@aanataliya

The inputs.conf could be created under your app also. Easy way to find is using btool

./splunk cmd btool inputs list --debug | grep 'your known string'
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...