Splunk Search

Format of configuration files

steveirogers
Communicator

Which of the following is the preferred syntax for setting values in configuration files?
disabled = [true|false] or disabled = [0|1]

The documentation for version 4.3 refers to "true|false". However, we are deploying Windows Lightweight Forwarders using the GUI and the command line and in both cases, the the generated "inputs.conf" file contains diabled = [0 | 1].

If we try to use disabled = [true | false], the inputs.conf file loses all the values as shown below:

[WinEventLog:Application]

[WinEventLog:ForwardedEvents]

[WinEventLog:HardwareEvents]

[WinEventLog:Internet Explorer]

[WinEventLog:Security]

[WinEventLog:Setup]

[WinEventLog:System]

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi steveirogers

the docs state the following:

The Security, Application, and System event log inputs are enabled by 
default.  To disable an input type, comment it out or set disabled = 1 in
$SPLUNK_HOME\etc\apps\windows\local\inputs.conf

or

disabled = [1|0] Enable (0) or disable (1) this input.

meaning disable = [1|0] is the correct way to enable or disable the inputs.

cheers

steveirogers
Communicator

Thanks very MuS. That clarified it for me.

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...