Dashboards & Visualizations

Should I ever edit any configuration files in $SPLUNK_HOME/etc/*/default/ ?

the_wolverine
Champion

Why shouldn't I edit any of the .../default/*.conf files?

1 Solution

the_wolverine
Champion

It is very rare that Splunk Support will ever ask you to edit any default configuration files. The danger in doing this is that a subsequent upgrade or migration will overwrite your configuration and cause Splunk to break.

There may be rare occasions where you will be asked to edit the default config files, perhaps to resolve a bug, and the subsequent upgrade/migration will work properly.

In general, do not edit default/*.conf files.

View solution in original post

Jason
Motivator

The only time I have ever had to edit an etc/system/default/ file is before first run, if I want to change the default admin username and password for the system. This is in etc/system/default/user-seed.conf; Splunk does not appear to pay attention to the file if it exists in local.

In other words, I only supply a modified one of these files if I'm building a package that installs splunk, installs some custom config, then starts splunk for the first time.

0 Karma

Jason
Motivator

Also, this does not appear to work as of 4.3.x.

0 Karma

the_wolverine
Champion

It is very rare that Splunk Support will ever ask you to edit any default configuration files. The danger in doing this is that a subsequent upgrade or migration will overwrite your configuration and cause Splunk to break.

There may be rare occasions where you will be asked to edit the default config files, perhaps to resolve a bug, and the subsequent upgrade/migration will work properly.

In general, do not edit default/*.conf files.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!