topic Re: can limits.conf and server.conf be placed inside etc/apps//default in Getting Data In

can limits.conf and server.conf be placed inside etc/apps//default

robf — Wed, 03 Jun 2015 17:51:24 GMT

title says it all? does not state clearly in docs like other files such as inputs.conf

Re: can limits.conf and server.conf be placed inside etc/apps//default

woodcock — Wed, 03 Jun 2015 17:56:25 GMT

These are global files so they should stay where they are.

Re: can limits.conf and server.conf be placed inside etc/apps//default

robf — Wed, 03 Jun 2015 18:28:09 GMT

i can see they can both be found in default install app for a windows UF:

splunk\etc\apps\SplunkUniversalForwarder\default\

I dont want to overwrite anything, only add. I would rather add config only in etc/apps/ for large deployment

Re: can limits.conf and server.conf be placed inside etc/apps//default

woodcock — Wed, 03 Jun 2015 18:41:37 GMT

Yes, the DS/DC case is the one case where it would be distributed in an app context. We, too have several OS-based "base" forwarder apps that have server-wide settings. This is OK because these apps are mutually-exclusive from eachother. The reason it is not a great idea is because precedence will cause your app's version of the file to be preferred over the system's version. In the case we described, this is desirable. In the case of a "regular" app, this could be disastrous and very poor form.

Re: can limits.conf and server.conf be placed inside etc/apps//default

the_wolverine — Wed, 03 Jun 2015 19:12:47 GMT

The issue with configuring these in ../default/ is that for any standard app distribution (e.g. search), the configuration file will be overwritten by any upgrade or re-install which applies the default configuration. This results in your custom config changes being wiped out.

Common practice is to put it in ../local/ to prevent the above scenario.

Re: can limits.conf and server.conf be placed inside etc/apps//default

robf — Thu, 04 Jun 2015 10:47:17 GMT

sorry, to clarify i meant
etc/apps//default
or
etc/apps//default

so not one of the splunkbase apps or default splunk apps.

Re: can limits.conf and server.conf be placed inside etc/apps//default

robf — Thu, 04 Jun 2015 10:48:28 GMT

thanks so over all this does work but the idea is to use local rather than default where you are in a splunk base or splunk default app.

Re: can limits.conf and server.conf be placed inside etc/apps//default

robf — Thu, 04 Jun 2015 10:49:18 GMT

thanks, yes as now i have added to my question i only meant my own custom app. not splunk base or default