Implementing Splunk 7, Third Edition - Third Edition

inputs.conf

This configuration, as you might guess, controls how data makes it into Splunk.

By the time this data leaves the input stage, it still isn't an event but has some basic metadata associated with it: host, source, sourcetype, and optionally index. This basic metadata is then used by the parsing stage to break the data into events according to the rules defined in props.conf.

Input types can be broken down into files, network ports, and scripts. First, we will look at the attributes that are common to all inputs.