Where is the stanza [splunktcp://9997] located?

The stanza [splunktcp://9997] is typically found in the inputs.conf file on a receiver. This input configuration specifically defines how the Splunk instance should accept incoming data via TCP on the designated port (9997 in this case).

When a receiver is set up to gather data from forwarders, the inputs.conf file plays a crucial role in specifying port entries for data ingestion. The stanza indicates that the receiver is waiting for data that is being sent to that specified TCP port, which is common practice for collecting logs and other data streams from forwarders.

Configurations related to data input, such as those defined in inputs.conf, manage how data flows into the Splunk environment, thus highlighting the importance of this file on the receiving end. Other configuration files, such as outputs.conf, props.conf, and transforms.conf, serve different purposes related to data forwarding, parsing, and transformation, but they do not pertain directly to defining data reception through specified TCP ports.