topic Re: $SPLUNK_HOME/etc/local/default use? in Getting Data In

$SPLUNK_HOME/etc/local/default use?

JimDeich — Mon, 28 Sep 2020 20:15:24 GMT

I have an app (Cloudpassage) that instructs to put a props.conf file in $SPLUNK_HOME/etc/local/default . I am not familiar with this dir and
cannot find much about it in documents. Does this have something to do with web interaction or modular inputs?

Plenty of somewhat similar dirs $SPLUNK_HOME/etc/system/local, $SPLUNK_HOME/etc/apps/appname/default,
$SPLUNK_HOME/etc/apps/appname/local ..

Non of our splunk install every have: $SPLUNK_HOME/etc/local .

Thanks!

Re: $SPLUNK_HOME/etc/local/default use?

ChrisG — Thu, 11 Jun 2015 22:05:02 GMT

It is important to understand how the configuration file directories work, where the active copies of the files go, and how precedence functions. See these documentation topics, they are fundamental to configuring Splunk software.

...and the topics that follow them in the Admin Manual.

Re: $SPLUNK_HOME/etc/local/default use?

JimDeich — Mon, 28 Sep 2020 20:15:30 GMT

Appreciated, but I need a specific answer for this directory and am NOT finding one. Do you know the purpose of this dir? This is not $SPLUNK_HOME/etc/system/local it is: $SPLUNK_HOME/etc/local . I am fairly familiar with most config dir.

Re: $SPLUNK_HOME/etc/local/default use?

JimDeich — Thu, 11 Jun 2015 22:59:56 GMT

All, I appreciate the general help, but I am looking for a specific answer for the directory :

$SPLUNK_HOME/etc/local/default use .

This is NOT $SPLUNK_HOME/etc/system/local/

Re: $SPLUNK_HOME/etc/local/default use?

ChrisG — Thu, 11 Jun 2015 23:01:59 GMT

Got it. I went and read the Cloudpassage doc page and I see exactly what you mean. That is a bit odd. I wonder if it's possible that their docs are wrong. Have you tried configuring it in /etc/system/local?

Re: $SPLUNK_HOME/etc/local/default use?

JimDeich — Thu, 11 Jun 2015 23:14:22 GMT

I'm starting to think it's a typo and maybe the mean /etc/system/local . Thanks for running to check on it.

Re: $SPLUNK_HOME/etc/local/default use?

Lucas_K — Thu, 11 Jun 2015 23:44:29 GMT

Its certainly a typo.