difference between /splunk/etc/system/local and /splunk/etc/apps/search/local

perlish — Thu, 02 May 2013 06:17:05 GMT

Hi, everybody.

What`s the difference between /splunk/etc/system/local and /splunk/etc/apps/search/local？

Re: difference between /splunk/etc/system/local and /splunk/etc/apps/search/local

sideview — Thu, 02 May 2013 06:26:12 GMT

You should read this page:
http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Wheretofindtheconfigurationfiles

Basically the former is the system default directory, which is the sort of base layer of the whole config system, and which can be overridden by several higher-precedence layer.

and the latter is the "local" directory of the search app's configuration layer. Which can be overridden by user-level config, but which itself overrides the search app's "default" config as well as all the "system" config, at least when you're in the search app.

but again, the real answers are all on this page: http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Wheretofindtheconfigurationfiles

Re: difference between /splunk/etc/system/local and /splunk/etc/apps/search/local

kristian_kolb — Thu, 02 May 2013 06:36:40 GMT

spent too much time editing...

topic Re: difference between /splunk/etc/system/local and /splunk/etc/apps/search/local in Security

difference between /splunk/etc/system/local and /splunk/etc/apps/search/local

Re: difference between /splunk/etc/system/local and /splunk/etc/apps/search/local

Re: difference between /splunk/etc/system/local and /splunk/etc/apps/search/local