I have been reading link:Splunk 4.2 Universal Forwarder *nix
Why does a universal forwarder need the entire *nix application, isn't the
3 - Copy /splunk/etc/apps/unix/default/app.conf to /splunk/etc/apps/unix/local/app.conf
4 - Edit the app.conf in the local directory to say: app=enabled
5 - Copy /splunk/etc/apps/unix/default/inputs.conf to /splunk/etc/apps/unix/local/
enough and then the rest of the app's directories can be deleted?
... View more