All Apps and Add-ons

Where default configuration stored?

jangid
Builder

Hi

I have installed another forwarder in Windows 7 machine with default setting and a directory name for monitor log files. after installation Splunk start send data to main instance.

Now question is where is default configuration(monitoring directory path) saved?

Thanks

Tags (1)
0 Karma
1 Solution

jangid
Builder

OK I have figure out this. It stored in MSICreated app.

C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf

Thanks

View solution in original post

0 Karma

jangid
Builder

OK I have figure out this. It stored in MSICreated app.

C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf

Thanks

0 Karma

yannK
Splunk Employee
Splunk Employee

You will find the defaults in the different /default/ folders
example on windows : $SPLUNK_HOME\etc\system\default and $SPLUNK_HOME\etc\apps<myapp>\default\

Please read the link from jbsplunk to understand precedence of configurations.

And important advice, NEVER cross the beams.

Ah no, actually it's Never edit a default configuration file, always create a new one in /local/ and add only the specific stanza and parameters to modify.

jangid
Builder

Thanks for info.
I was looking my initial setup setting during installation.

During installation I provided directory "c:\mylog\" to monitor all files in this directory, now I want to check where this information is saved in Splunk, I didn't find anywhere in Spllunkforwarder*.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

I am not sure I understand your question, but I think a good place to start is here:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Apparchitectureandobjectownership

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...