View configurations installed on forwarders

When the Effective Configuration add-on is installed on forwarders in your organization, you can view the parameter values that are installed in .conf files on forwarders. You can also check the default values for parameters. If you prefer to view the configuration in a different editor, you can download the Effective Configuration add-on files.

  1. Log in to Splunk Enterprise.
  2. Select the settings icon (Settings), and then under the Distributed Environment section, select Agent management.

    The Agent management page opens.

  3. On the Agent management page, select a forwarder on which the effective configuration is installed.
  4. On the Forwarder page, select the Effective Configuration tab. Under this tab, you can view the configuration you received from the agent. The 4 tabs indicate the inputs.conf, outputs.conf, deploymentclient.conf, and server.conf files.
  5. Select a tab to view the configuration in a given .conf file.
  6. To view the whole configuration with default values, turn on the Show default values toggle.
    • The default values are indicated by the gray color.
    • The values that were updated are indicated by the white color.

    Turn off the Show default values toggle to view the updated values that are installed on the forwarder.

  7. Use the search bar to find a value that you want to check.
  8. Check the time when the effective configuration was generated and uploaded. Hover over the time in the Generated and Uploaded fields.
    • The Generated field shows the date and time when btool was run on the agent to generate effective configuration.
    • The Uploaded field shows the date and time when the server saved the effective configuration received from the agent.