Key Configuration Files

inputs.conf defines what data Splunk collects — file monitors, network listeners, scripted inputs, and more.

outputs.conf controls where data is forwarded to — which indexers or indexer clusters receive the data.

props.conf and transforms.conf work together for data parsing — source type recognition, timestamp extraction, field extraction, and event breaking.

server.conf contains general server settings like the server name, SSL configuration, and replication settings.