I am new to Splunk to please excuse the noob question. I could not readily find the answer elsewhere.
In this test environment, I have one Universal Forwarder installed on a Domain Controller. I am wanting to tweak what it sends and know this is done via the inputs.conf file. My question is, which inputs.conf file do I need to edit? Within the Universal Forwarder folder on the host, there are several instances of an inputs.conf file. I do know the one under system/default is where it references default settings if not explicitly listed different elsewhere but I assume it is not best practice to readily edit this one.
Also, I see a mention in the Splunk documentation where you can create an ideal inputs.conf file on the Splunk server itself and push that out to your Universal Forwarders. Could you provide any documentation or a link on how to do this?
... View more