Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Empty /etc/deployment-apps/MyApp/local/inputs.conf after deployment???

$
0
0
Hello guys, I have an indexer as a deployment server, and I create a local app MyApp Inside the local folder I have a inputs.conf with: [WinEventLog://Application] disabled = 0 index = windows_server_index [WinEventLog://Security] disabled = 0 index = windows_server_index [WinEventLog://System] disabled = 0 index = windows_server_index I deployed the app successfully to the UF, it is collecting logs, but every time I go back to the deployed-app inputs.conf, it is empty Another thing that happens, is that event log collection is losing association with the Server Class. If I delete them, it gets re-associated ![alt text][1] Any ideas? JD [1]: /storage/temp/133190-screen-shot-2016-05-27-at-101618-am.png

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>