it would seem for modular inputs, the inputs.conf that the stanza is created in depends on the "context" in which you launch Settings | Data Inputs
localhost:8000/en-us/manager/launcher/datainputstats
mod-input inputs.conf stanza created in /etc/apps/launcher/local/inputs.conf
localhost:8000/en-us/manager/search/datainputstats
mod-input inputs.conf stanza created in /etc/apps/search/local/inputs.conf
localhost:8000/en-us/manager/{app}/datainputstats
mod-input inputs.conf stanza created in /etc/apps/{app}/local/inputs.conf
Seems strange to me....
I would have expected it to be created at
mod-input inputs.conf stanza created in /etc/apps/{actual-modular-input}/local/inputs.conf
In any event, i have some code that also updates the input.config and it will create the updated configuration in:
mod-input inputs.conf stanza created in /etc/apps/{app}/local/inputs.conf
but will only contain the updated values.
Everything is fine when you use the api / modular input until you try and delete the modular input, and then everything goes haywire and it's not possible to actually delete the input.
i'm using splunk Version:
7.1.2
Build:
a0c72a66db66
... View more