As a best practice, you should put the inputs.conf in one of the apps, not the system level directory. if there is an app that is appropriate, then clearly that works. For example, if you are talking about an F5 log input and you have the F5 app installed, the inputs.conf should clearly go in the local directory of the F5 app. If the input is not directly associated with any app, you might create an app, just as a place to house general configuration files. Or people sometimes choose to use the "search" app for that purpose. ... View more

Bang on! Our deployment template was adding a time retention of 14 days by default in etc/system/local/indexes.con that I overlooked. The indextest script is completing now. Thanks guys. ... View more

Hi Takajian, We've removed the pyreadline dependency in version 2.0.1 of SplunkIt - let us know if that doesn't work for you. Thanks! ... View more