50.7k views
2 votes
What .conf file should you configure in your forwarder if you have input phase settings?

1) inputs.conf
2) outputs.conf
3) props.conf
4) transforms.conf

User FakeMake
by
8.0k points

1 Answer

7 votes

Final answer:

To configure input phase settings in a forwarder, you should edit the inputs.conf file, which handles data input configurations for Splunk forwarders.

Step-by-step explanation:

If you need to configure input phase settings in a forwarder, the correct configuration file to edit is inputs.conf. This file allows you to define and configure data inputs for the Splunk forwarder, such as setting the data source, type, and other specific settings that control how the forwarder collects data. Should you need to configure forwarding destinations and network settings, you would use outputs.conf. The files props.conf and transforms.conf tend to be used for data transformations and parsing during the indexing phase, rather than at the input phase.

User Andy Webb
by
8.8k points