There are many inputs.conf. However, it's better to do the configuration in Splunk_Home/etc/apps/search/local/inputs.conf ... View more

You will need to manually define the sourcetype in the inputs.conf under the monitor stanza: http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/Bypassautomaticsourcetypeassignment ... View more

Along with the App, you'll need to install the "Cisco Networks Add-on" and to use the sourcetype cisco:ios for the Syslog data sent from the switches and routers. ... View more

I'm guessing you're using the iplocation with an "IP" field? Is the value "185.59.46.158"? I've tried the splunk iplocation command on this IP and it's showing Turkey not Germany. ... View more

You will need a Windows machine to collect WMI data. If your Splunk setup is non-Windows, you'll need a separate Windows instance running HF or UF. See the paragraph "Search Windows Data on a non-Windows Instance of Splunk Enterprise": http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/ConsiderationsfordecidinghowtomonitorWindowsdata#Polling_data_remotely_over_WMI.3F_Be_sure_to_read_this If you opt for a UF, you cannot configure the WMI from the web interface but you can do the same through the wmi.conf: http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/MonitorWMIdata ... View more

You can install Splunk Heavy Forwarder on a windows machine, collect WMI data and forward them to your Splunk Indexers running on RedHat 6. ... View more