All Apps and Add-ons

Where default configuration stored?

jangid
Builder

Hi

I have installed another forwarder in Windows 7 machine with default setting and a directory name for monitor log files. after installation Splunk start send data to main instance.

Now question is where is default configuration(monitoring directory path) saved?

Thanks

Tags (1)
0 Karma
1 Solution

jangid
Builder

OK I have figure out this. It stored in MSICreated app.

C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf

Thanks

View solution in original post

0 Karma

jangid
Builder

OK I have figure out this. It stored in MSICreated app.

C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf

Thanks

0 Karma

yannK
Splunk Employee
Splunk Employee

You will find the defaults in the different /default/ folders
example on windows : $SPLUNK_HOME\etc\system\default and $SPLUNK_HOME\etc\apps<myapp>\default\

Please read the link from jbsplunk to understand precedence of configurations.

And important advice, NEVER cross the beams.

Ah no, actually it's Never edit a default configuration file, always create a new one in /local/ and add only the specific stanza and parameters to modify.

jangid
Builder

Thanks for info.
I was looking my initial setup setting during installation.

During installation I provided directory "c:\mylog\" to monitor all files in this directory, now I want to check where this information is saved in Splunk, I didn't find anywhere in Spllunkforwarder*.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

I am not sure I understand your question, but I think a good place to start is here:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Apparchitectureandobjectownership

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...