topic Where in the system directories and files do I find changes made in the Splunk Web UI? in Security

Where in the system directories and files do I find changes made in the Splunk Web UI?

horsefez — Tue, 03 Feb 2015 16:46:27 GMT

Hi,
I'm using Splunk on a linux-machine and accessing it successfully through the Splunk Web UI.
Today I've added a new user.

In which directory on the system will the changes be written to?
Which directory leads to the file where the configuration of the new user is set?
Do I have to restart any service before the changes are displayed?

Thanks in advance!

Re: Where in the system directories and files do I find changes made in the Splunk Web UI?

chanfoli — Mon, 28 Sep 2020 18:49:32 GMT

Normally when you install splunk enterprise $SPLUNK_HOME is defined as /opt/splunk, most splunkweb config changes end up in various conf files under $SPLUNK_HOME/etc/system/local or $SPLUNK_HOME/etc/apps/SOMEAPPNAME/local depending on the context of the changes. Splunk native authentication configuration is a bit of a special case, you can see some info on this here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Usernameprecedence

You can also see some detail on general config precedence rules here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Wheretofindtheconfigurationfiles

Generally configurations are saved and loaded dynamically when made through splunkweb and it should tell you if a service restart is required when you commit a particular change.

Re: Where in the system directories and files do I find changes made in the Splunk Web UI?

horsefez — Thu, 05 Feb 2015 08:17:05 GMT

Thank you! 🙂