I was pretty sure back when we installed the system we limited a bunch of things, but now I cannot find the configuration anywhere.  In the typical /opt/splunk/etc/system/local on my Splunk Server I do not seem to have the inputs.conf file anymore?  Is there where I would limit my ingesting or do I do it on the Splunk Forwarder level? I am getting a lot of 4634 which is filling up my license quota.  I want to not log the Logon Type 3's.  Can I just create the file where it should be and start adding things there or how should I go about it? ... View more

I have scoured the forums and checked the web_service.log but I can't seem to be able to figure out what my problem is.  What can I be looking for?   Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _internal _introspection _metrics _metrics_rollup _telemetry _thefishbucket history main nagios nix perfmon summary windows Done Checking filesystem compatibility... Done Checking conf files for problems... Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-8.1.2-545206cc9f70-linux-2.6-x86_64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done Waiting for web server at https://127.0.0.1:8000 to be available.. ... View more