Getting Data In

splunk forwarder local vs app

GArienti
Explorer

I understand when I install a windows forwarder I end up with MSI.., learned, univforw, serac, etc...

My question is this, if I am just monitoring a couple of things, can I just enter it in the input.conf under etc/local/system instead of under the apps?
What's the difference? why some fields show up in my "learned" props.conf? I didn't put them in there.

I am using windows forwarder to monitor daily logs and event viewers, nothing else, can I ALL my inputs, props and transform under here: C:\Program Files\SplunkUniversalForwarder\etc\system\local
??

0 Karma
1 Solution

lukejadamec
Super Champion

It is generally not a good idea to put your input and other configurations under etc/system/local because that directory cannot be managed with a Deployment Server.

The learned app will be automatically maintained because that is where Splunk puts configurations that were 'learned' automatically by Splunk. One example is an input without a specified sourcetype. If the structure of the log changes, Splunk may create a new sourcetype and place it's definition in the learned app. If you don't want to use the learned sourcetype, then you can override it by specifying the sourcetype explicitly in for that input in inputs.conf.

You can consolidate you inputs, transforms, props config files in a single app. My preference is to create a my own app folder, and manage it with a deployment server. You just need to make sure that you remove all of the conflicting configs that may exist on the system.

View solution in original post

lukejadamec
Super Champion

It is generally not a good idea to put your input and other configurations under etc/system/local because that directory cannot be managed with a Deployment Server.

The learned app will be automatically maintained because that is where Splunk puts configurations that were 'learned' automatically by Splunk. One example is an input without a specified sourcetype. If the structure of the log changes, Splunk may create a new sourcetype and place it's definition in the learned app. If you don't want to use the learned sourcetype, then you can override it by specifying the sourcetype explicitly in for that input in inputs.conf.

You can consolidate you inputs, transforms, props config files in a single app. My preference is to create a my own app folder, and manage it with a deployment server. You just need to make sure that you remove all of the conflicting configs that may exist on the system.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...