Hi @lutzmw, we're speaking of two different things: I'm speaking of the last Splunk Add-On for Microsoft Windows (https://splunkbase.splunk.com/app/742/) and its last release is 8.5; instead you're speaking of the inputs.conf in $SPLUNK_HOME/etc/system/default, in other words the default inputs.conf of Splunk. This means that your file is the inputs.conf that you find by default in Splunk and the inputs you're speaking  are the modular inputs present by default in Splunk and that you can see in the GUI. Ciao. Giuseppe ... View more

Hi it's just like @PickleRick said, if you have splunk enterprise component on node there is no need for UF on that host. BUT if you have automatic provisioning on those host (e.g. in AWS or other cloud environment) then it may be that you have already UF installed on all nodes. Then it could be an option to use it as a "standard" solution to collect logs. If you select this option you must ensure that e.g. startup scripts, service names and so on are different for UF and Splunk server components. I cannot said which option is better use UF or install those inputs as an apps to e.g. indexers? Some people (e.g. I) don't like to idea to install any additional components/apps to indexers, but it's not forbidden. r. Ismo ... View more