Getting Data In

Is there a "Data inputs" screen for the forwarders?


My goal is to pull in some info from perfmon, specifically from the APP_POOL_WAS object.

I read this page here:

I went to Settings > Data inputs > Local performance monitoring and defined a new collection based on the object and counters I wanted.

Then, I added a stanza in the /etc/system/local/inputs.conf that described that data I wanted to be forwarded.

I then searched for collection=<thenameofmynewcollection> and all I found were records from my indexer host, not the web server I want to monitor. However, I cannot find a stanza in any inputs.conf on the search head/indexer that reflects the change.

  • Is Data inputs just a screen to
    modify the inputs.conf on the search

  • Is there any way to get a
    pretty interface like that for the

  • Why do you think my events are not be
    forwarded from the web server? (sort
    of a separate issue I guess)

  • Please help

0 Karma

Splunk Employee
Splunk Employee

The Web interface exists only on the splunk build, not on the Universal Forwarder.


However you can turn a regular splunk into :
- a HF heavy forwarder (it will parse the events, but forward the cooked data to another server) and the UI will be up.
- or a LWF light weight forwarder (it will not parse the events, like an universal forwarder) but the UI will be disabled.

I would recommend to use the LWF, and re-enable it in web.conf

startwebserver =true

0 Karma

Splunk Employee
Splunk Employee

I see, my personal method when I have a large set of forwarder to setup.
- use a regular splunk UI to setup the inputs
- verify the inputs
- copy the config generated in the apps
- install/deploy the apps to the forwarders
- go home early

0 Karma


Why then does it say everywhere to use Splunk web rather then edit inputs.conf directly? For a universal forwarder the only option is to edit the files directly. I guess that is why I was confused. Seriously, this is on all the documentation about inputs.conf

"While you can add
performance monitor inputs manually, Splunk recommends that you use Splunk Web
to configure them, because it is easy to mistype the values for
Performance Monitor objects, counters and instances."

0 Karma


Thanks. I was some what aware of this. My take away was "just use the universal forwarder, don't worry about anything else"

I guess I was hoping there would be some feature on the search head to graphically maniuplate inputs.conf across forwarders.

Seems like it would make sense to have a Splunk app that could modify inputs.conf across a large number of forwarders. What do large deployments do? Git or Puppet or something I imagine?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>