Here are some quick thoughts. Restrict access to the account running Splunk and to root. Make sure inputs.conf files only can be edited by the Splunk account. Create a scripted input that deletes all local/input.conf files. Push this from your Deployment Server and have it run every hour or so. Note: the script doesn't have to produce any input, although it may be useful to have it report when it finds a file to delete. ... View more