Being new to Splunk, do my inputs.conf and outputs.conf look correct on my local PC?

[rsingh]

deploymentclient.conf

[target-broker:deploymentServer]
targetUri = splunk.domain.com:8089

outputs.conf

[tcpout]

server = splunk.domain.com:8089

[tcpout-server://splunk.domain.com:8089]

inputs.conf

[default]
host = MYPC257

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

[WinEventLog://Security]
index=security
current_only=1
evt_resolve_ad_obj=0
renderXml=1
disabled=0

Logon Failures

index=windows 
LogName=Security EventCode=4625 | table _time, Workstation_Name, Source_Network_Address,
host, Account_Name

Monitor for Administrative and Guest Logon Failures

index=windows 
LogName=Security 
EventCode=4625 (Account_Name=_administrator OR Account_Name=guest) | stats
count values(Workstation_Name) AS Workstation_Name, 
Values(Source_Network_Address) 
AS Source_IP_Address,values(host) AS Host by Account_Name | where count > 3

[lguinn2 · Accepted solution]

deploymentclient.conf: if splunk.domain.com is running the deployment server, then splunk.domain.com:8089 is probably correct. 8089 is the default management port.

However, port 8089 is probably wrong for outputs.conf. You need to find out the receiving port that is configured on splunk.domain.com. Often, 9997 is used, but there is no default. You need to replace the 8089 with the proper port number everywhere in this file.

I have no idea if the inputs.conf or the searches are correct.