Splunk Search

Help on inputs.conf

jip31
Motivator

Hi

I have a basic questions about the inputs.conf file

In our apps, we have a inputs.conf file under etc/apps/test/inputs.conf what is normal

But what is the difference between

etc/system/local/inputs.conf and etc/apps/test/inputs.conf ?

Is the inputs.conf file under system is an agrégation of all the inputs.conf files of every apps? And which inputs.conf file is taking into account first? The one in system or the one in the apps?

Regards

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, Splunk merges the settings for inputs.conf from all enabled apps as well as system/default and system/local to arrive at what the complete list of inputs will be.  See the Admin Manual at https://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/Wheretofindtheconfigurationfiles for a description of configuration file precedence.

Note that etc/apps/test/inputs.conf will be ignored by Splunk because it is not in a local or default directory.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, Splunk merges the settings for inputs.conf from all enabled apps as well as system/default and system/local to arrive at what the complete list of inputs will be.  See the Admin Manual at https://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/Wheretofindtheconfigurationfiles for a description of configuration file precedence.

Note that etc/apps/test/inputs.conf will be ignored by Splunk because it is not in a local or default directory.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...