https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311670#M11790 <P>Any configuration in <CODE>$SPLUNK_HOME/etc/system/local/</CODE> is GOD and cannot be overridden by anything in <CODE>$SPLUNK_HOME/etc/apps/</CODE> (the stuff that is pulled in from the Deployment Server). You have to migrate that stuff out of <CODE>$SPLUNK_HOME/etc/system/local/</CODE> first (it never should have been put there).</P> Fri, 01 Sep 2017 00:33:44 GMT woodcock 2017-09-01T00:33:44Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311666#M11786 <P>I need to make some changes and Splunk proServe tells me that I can use the deployment server to make this change. How is this done outside of the ../etc/systemp/local/ dir? Bundle it in an app? If so what about precedence? </P> <P>Any guidance is appreciated!</P> Thu, 31 Aug 2017 17:52:01 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311666#M11786 brent_weaver 2017-08-31T17:52:01Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311667#M11787 <P>Interesting thing. For <CODE>/opt/splunk/etc/system/local/server.conf</CODE> on the SH, for example, I make the changes on each SH and bounce each one. The deployment server only deploys to the forwarders...</P> Thu, 31 Aug 2017 18:15:28 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311667#M11787 ddrillic 2017-08-31T18:15:28Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311668#M11788 <P>yes you will bundle configurations in an app.<BR /> splunk configuration precedence is*: <BR /> 1. System local directory -- highest priority<BR /> 2. App local directories <BR /> 3. App default directories <BR /> 4. System default directory -- lowest priority</P> <UL> <LI>indexers in a cluster (slaves) have slightly different precedence order. read more here: <A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles</A></LI> </UL> <P>hope it helps</P> Thu, 31 Aug 2017 18:16:57 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311668#M11788 adonio 2017-08-31T18:16:57Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311669#M11789 <P>the deployment server can deploy to any non-clustered splunk instance<BR /> Indexer, Search Head, Heavy Forwarder and more<BR /> also, it can not deploy to itself</P> Thu, 31 Aug 2017 18:28:33 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311669#M11789 adonio 2017-08-31T18:28:33Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311670#M11790 <P>Any configuration in <CODE>$SPLUNK_HOME/etc/system/local/</CODE> is GOD and cannot be overridden by anything in <CODE>$SPLUNK_HOME/etc/apps/</CODE> (the stuff that is pulled in from the Deployment Server). You have to migrate that stuff out of <CODE>$SPLUNK_HOME/etc/system/local/</CODE> first (it never should have been put there).</P> Fri, 01 Sep 2017 00:33:44 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311670#M11790 woodcock 2017-09-01T00:33:44Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311671#M11791 <P>OK this is exactly what I thought, I appreciate your time!<BR /> Thanks everyone.</P> Tue, 05 Sep 2017 12:09:50 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-make-changes-to-server-conf/m-p/311671#M11791 brent_weaver 2017-09-05T12:09:50Z