In many examples (on splunk.com, in training class slides, and elsewhere) I see a "disabled = false" setting in many inputs.conf [monitor] stanzas. However, the only documentation I see for this setting is on http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf and it doesn't list what the default is, for example. Are there other docs with more details on the setting, what the default is, and why it is included in many example stanzas but not all? In particular, do I need to be adding this setting to all my [monitor] stanzas?
... View more