Configure your inputs
To add a new type of data to your Splunk deployment, configure a data input. There are a number of ways to configure data inputs:
- Apps. Splunk has a variety of apps that offer preconfigured inputs for various data types. For more information, see Use apps to get data in.
- Splunk Web. You can configure most inputs using the Splunk Web data input pages. You can access the Add Data landing page from Splunk Home. In addition, when you upload or monitor a file, you can preview and make adjustments to how the file is to be indexed..
- The Splunk Command Line Interface (CLI). If you have Splunk Enterprise, you can use the CLI to configure most types of inputs.
- The inputs.conf configuration file. When you specify your inputs with Splunk Web or the CLI, the details are saved in a configuration file, inputs.conf. If you have Splunk Enterprise, you can edit that file directly. Some advanced data input needs might require you to edit it.
Use Splunk Web
You can add data inputs from Splunk Home or the Settings > Data Inputs menu
- From Splunk Home, select Add Data
- Select Settings > Add data
- Select Settings > Data inputs from the Data section of the Settings pop-up menu.
The Add Data page has options to get data in. Click an icon to go to a page to define the data you want to upload, monitor, or forward.
For more help on how to use the "Add Data" page, see How do you want to add data?
How app context determines where Splunk Enterprise writes configuration files
When you add an input through Splunk Web, Splunk Enterprise adds that input to a copy of
inputs.conf. The app context, that is, the Splunk app you are currently in when you configure the input, determines where Splunk Enterprise writes the
For example, if you navigated to the Settings page directly from the Search page and then added an input, Splunk Enterprise adds the input to
When you add inputs, confirm that you are in the app context that you want to be in. For background on how configuration files work, read About configuration files in the Admin manual.
Use the CLI
If you have Splunk Enterprise, you can use the Splunk CLI to configure many inputs. From a shell or command prompt, navigate to the
$SPLUNK_HOME/bin/ directory and use the
./splunk command. For example, the following command adds
/var/log/ as a data input:
splunk add monitor /var/log/
For more information on the CLI, including how to get command line help, see About the CLI in the Admin manual.
You can edit inputs.conf to configure your inputs. You use a text editor to create or modify the file, where you can add a stanza for each input. You can add the stanza to the
inputs.conf file in
$SPLUNK_HOME/etc/system/local/, or in your custom application directory (in
You can configure the data input by adding key/value pairs to its stanza. You can set multiple settings in an input stanza. If you do not specify a value for a setting, Splunk Enterprise uses the default setting value. Default values for all
inputs.conf attributes are in
If you have not worked with configuration files, see About configuration files. before starting to add inputs.
Example inputs.conf stanza
The following example configuration directs Splunk Enterprise to listen on TCP port 9995 for raw data from any remote host. Splunk Enterprise uses the DNS name of the remote host to set the host of the data. It assigns the source type "log4j" and the source "tcp:9995" to the data.
[tcp://:9995] connection_host = dns sourcetype = log4j source = tcp:9995
For information on how to configure a specific input, see the topic in this manual for that input. For example, to learn how to configure file inputs, see Monitor files and directories with inputs.conf.
The topic for each data input describes the main attributes available for that input. See the
inputs.conf spec file for the complete list of available attributes, including descriptions of the attributes and several examples.
Use apps to get data in
How Splunk Enterprise handles your data
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1