When I install the universal forwarder on a Windows server via the GUI, I have the option to add inputs with check boxes, like Perfmon monitors, Event logs, and folders. However, when I go to: "C:\Program Files\SplunkUniversalForwarder\etc\system\local" I don't see any of those options I've selected previously saved in the configs there.
Where are they saved to and what is the best way to change the options I selected at install?
SPLUNK_HOME\etc\apps\MsiCreated
It was in here:
SPLUNK_HOME\etc\apps\MsiCreated
Thanks!