I could have sworn it was []
but that did not seem to work, nor did [*]
I do not want to use [default]
because I don't want to change all inputs on the host, just the ones in a given file.
I could swear I've seen this done, and it should be easy but I searched and searched to no avail.
Please help!
This is not the way it works, they are no notion stanza limited to a single inputs.conf or a single app.
The parameter are specific to their specific stanza.
The only exception is the [default] that is for all stanza (in all the apps)
Maybe are you confused with the props.conf that may overlap.
See the way splunk configuration merges, and use btool to verify :
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles
http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...
This is not the way it works, they are no notion stanza limited to a single inputs.conf or a single app.
The parameter are specific to their specific stanza.
The only exception is the [default] that is for all stanza (in all the apps)
Maybe are you confused with the props.conf that may overlap.
See the way splunk configuration merges, and use btool to verify :
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles
http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...
Oh. Well then. 😕