https://community.splunk.com/t5/Splunk-Enterprise/what-directory-should-I-put-commands-conf/m-p/28588#M8502 <P>You could make changes to a file in /etc/apps/search/default/and they would work, until you upgraded. The reason you're instructed to make changes in /local is that those changes are preserved on upgrade. So yes, you should either copy, or make a new file called commands.conf in $SPLUNK_HOME/etc/apps/search/local for your new command. </P> Tue, 17 Apr 2012 19:47:17 GMT jbsplunk 2012-04-17T19:47:17Z https://community.splunk.com/t5/Splunk-Enterprise/what-directory-should-I-put-commands-conf/m-p/28587#M8501 <P>I am in /opt/apps/splunk/etc/apps/search/default</P> <P>when I edit commands.conf it says</P> <P>DO NOT EDIT THIS FILE!</P> <H1>Please make all changes to files in $SPLUNK_HOME/etc/system/local</H1> <P>does that mean I should make a new commands.conf with my new command and place in /opt/apps/splunk/etc/apps/search/local ?</P> <P>thanks</P> Tue, 17 Apr 2012 19:33:16 GMT https://community.splunk.com/t5/Splunk-Enterprise/what-directory-should-I-put-commands-conf/m-p/28587#M8501 alexl1 2012-04-17T19:33:16Z https://community.splunk.com/t5/Splunk-Enterprise/what-directory-should-I-put-commands-conf/m-p/28588#M8502 <P>You could make changes to a file in /etc/apps/search/default/and they would work, until you upgraded. The reason you're instructed to make changes in /local is that those changes are preserved on upgrade. So yes, you should either copy, or make a new file called commands.conf in $SPLUNK_HOME/etc/apps/search/local for your new command. </P> Tue, 17 Apr 2012 19:47:17 GMT https://community.splunk.com/t5/Splunk-Enterprise/what-directory-should-I-put-commands-conf/m-p/28588#M8502 jbsplunk 2012-04-17T19:47:17Z