What is MSICreated app in splunk. how it is created and its use

[mala_splunk_91]

Hi ,

someone please answer on this.

I see "MSICreated" app created on some splunkforwaders. But, I was not there while installing Splunk universal forwarder on those servers.

Want to know , How this App been created and what is the use of it?

Thanks
Mala S

[andrewb_splunk]

The Windows MSI installer creates the MSICreated app during installation. This app provides a context in which to modify the outputs.conf file to determine forwarding behavior. You don't want to modify the outputs.conf in the default directory, and this app gives you a non-default outputs.conf to modify.

This answer is based on what's in the documentation. I don't have any particular knowledge in this area. See http://docs.splunk.com/Documentation/Forwarder/7.1.2/Forwarder/Configureforwardingwithoutputs.conf.