Exploring inputs.conf using the Splunk Add-on for Microsoft Windows
To appreciate the power of Splunk, we have to first ingest data. This data can come from various sources using various methods. However, we will need to tell Splunk how to ingest this data. This process of creating new configurations that instruct Splunk on where to find the new data is called onboarding. It can be accomplished by modifying configuration files, running commands using the Splunk CLI, or by using readymade forms or widgets in Splunk Web. In this section, we will investigate how Splunk inputs can be configured by modifying the Splunk inputs.conf configuration file. Every app in Splunk has a basic structure (bin, etc, and default folders). Remember that the default configuration files can be found in the default directory. However, we should never make changes within this directory. Instead, any new configurations or modifications should be made in the local directory. Therefore, the default inputs.conf...