9.3 Splunk Input Options
Key Takeaways
- Common inputs include [monitor://] (files and directories), [batch://] with move_policy = sinkhole, [tcp://] and [udp://], [splunktcp://] (receiving from forwarders), [script://], and [http://<token>] for HEC.
- Windows machines add WinEventLog, perfmon, WinRegMon, admon, WinHostMon, WinPrintMon, WinNetMon, MonitorNoHandle, and powershell inputs; remote agentless collection uses WMI in wmi.conf.
- A universal forwarder can run monitor, batch, network, scripted, and Windows inputs (including remote WMI on Windows), but not HTTP Event Collector.
- Splunk Web's Add Data offers Upload (one file), Monitor (local inputs), and Forward (inputs on deployment clients through the deployment server).
- Every input sets host, source, sourcetype, and index; index defaults to main and TCP inputs set host by reverse DNS unless connection_host is changed.
Last updated: September 2026
Splunk Input Options
Blueprint objective 9.2 asks you to list Splunk input options. Every input is configured in inputs.conf (wmi.conf for WMI) or through Settings > Add Data and Settings > Data inputs in Splunk Web, and every input assigns the same metadata: host, source, sourcetype, and index. What differs is where the data comes from and which Splunk component can run the input.
The Input Families
| Input family | Stanza in inputs.conf | What it collects | Runs on a universal forwarder? |
|---|---|---|---|
| Files and directories (monitor) | [monitor://<path>] | Continuously tails files and directory trees, including rotated and compressed files | Yes, the most common UF input |
| Batch | [batch://<path>] with move_policy = sinkhole | Reads files once and deletes them (destructive loading) | Yes |
| Upload / oneshot | Splunk Web Upload, or splunk add oneshot | A single file indexed once | Oneshot from the CLI |
| Network: TCP / UDP | [tcp://<port>], [udp://<port>], [tcp-ssl:<port>] | Raw data pushed over the network (syslog and similar) | Yes |
| Splunk-to-Splunk receiving | [splunktcp://<port>], [splunktcp-ssl:<port>] | Data from other Splunk forwarders (usually port 9997 on indexers) | Used by intermediate forwarders |
| Scripted | [script://<cmd>] | Output of a script or program run on a schedule | Yes (no bundled Python on a UF) |
| HTTP Event Collector (HEC) | [http://<token_name>] plus the global [http] stanza | JSON or raw events sent over HTTP/HTTPS with a token (port 8088 by default) | No: heavy forwarder, indexer, or other full instance |
| Windows inputs | [WinEventLog://<channel>], [perfmon://<name>], [WinRegMon://<name>], [admon://<name>], [WinHostMon://<name>], [WinPrintMon://<name>], [WinNetMon://<name>], [MonitorNoHandle://<path>], [powershell://<name>] | Event logs, performance counters, registry, Active Directory, host, print, and network monitoring on the local Windows machine | Yes (Windows UF) |
| Remote Windows via WMI | [WMI:<name>] in wmi.conf | Event logs or WQL queries from remote Windows machines, with no agent on the target | Yes, on a Windows universal or heavy forwarder running as a domain user |
| FIFO queues | [fifo://<path>] | Data written to a named pipe | Yes |
| Linux/macOS system logs | [journald://<name>], [logd://<name>] | systemd journal (Linux) and unified logging (macOS) | Yes |
| Modular inputs | [<scheme>://<name>] defined by an app or add-on | API-based and specialized sources (for example DB Connect, cloud services) | Depends on the add-on; many need a heavy forwarder |
How to Choose
- Is the data in files on a host you can install software on? Use a universal forwarder with a
monitorinput. It keeps track of where it stopped reading, survives restarts, and can use indexer acknowledgment. - Is the data pushed over the network? For syslog, Splunk's usual design is a syslog server that writes to disk, with a UF monitoring those files. Direct
udp/tcpinputs work, but data sent while the listener is down is lost. - Does an application prefer to send HTTP? Use HEC tokens on a full instance (often heavy forwarders behind a load balancer, or the indexers).
- Does the data come from running a command or API? Use a scripted input or a modular input from an add-on.
- Is the source a Windows server? Use the Windows inputs on a Windows UF. Use WMI only when you cannot install an agent on the target. WMI needs a Splunk instance on Windows, such as a universal or heavy forwarder running as a domain user, plus open RPC ports, and Splunk says its load often exceeds that of installing a forwarder.
Where Inputs Are Created
- Splunk Web: Settings > Add Data offers Upload (one file), Monitor (files, directories, network ports, scripts, HEC, Windows inputs on the local instance), and Forward (configure inputs on deployment clients through the deployment server).
- CLI:
splunk add monitor,splunk add oneshot,splunk add tcp,splunk add udp, and so on. The CLI writes the stanza to aninputs.conffile. - Configuration files: write
inputs.confstanzas directly, usually inside an app or add-on, and deploy them to forwarders with the deployment server.
Metadata Defaults to Remember
| Metadata | Default |
|---|---|
index | default, which resolves to main |
host | The instance's host name. Network inputs use connection_host (dns for TCP, ip for UDP by default) |
source | The file path, tcp:<port> / udp:<port>, the script path, or http:<token name> for HEC |
sourcetype | Whatever you set. Otherwise Splunk assigns one automatically, and for UDP with no source type the default is udp:<port> |
Exam tip: When a question asks "which input type" for a scenario, match the source first (file, network port, script, HTTP, Windows API, or remote WMI), then check which component can run it. A universal forwarder cannot run HTTP Event Collector.
Test Your Knowledge
An application team wants its microservices to send JSON events over HTTPS with a token, and there is no agent on the containers. Which input type fits, and where does it run?
A
B
C
D
Test Your Knowledge
Which of these inputs cannot be configured on a universal forwarder?
A
B
C
D
Test Your Knowledge
You need to load a folder of historical CSV exports exactly once and remove the files afterwards. Which input matches that behavior?
A
B
C
D