Getting Data In

Windows Universal Forwarder - initial configuration settings dont seem to be in *.conf


When installing a UF on Windows, the installer prompts for sources to forward, including event logs or a path.

I put in a path to some IIS logs but have come to regret my decision. I want to change the values, but I can't find them.

They aren't in

C:\Program Files\SplunkUniversalForwarder\etc\system\local\outputs.conf


C:\Program Files\SplunkUniversalForwarder\etc\system\default\outputs.conf

Where are the settings captured during the install and how can I change them?

0 Karma


Ok, found it under SplunkTAwindows. So which is the preferred location to declare directories I want monitored?

0 Karma

Revered Legend

The conf file to look for will be inputs.conf. Search inputs.conf in following locations

C:\Program Files\SplunkUniversalForwarder\etc\system\local
C:\Program Files\SplunkUniversalForwarder\etc\system\default
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local

Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...