Dashboards & Visualizations

Should I ever edit any configuration files in $SPLUNK_HOME/etc/*/default/ ?

the_wolverine
Champion

Why shouldn't I edit any of the .../default/*.conf files?

1 Solution

the_wolverine
Champion

It is very rare that Splunk Support will ever ask you to edit any default configuration files. The danger in doing this is that a subsequent upgrade or migration will overwrite your configuration and cause Splunk to break.

There may be rare occasions where you will be asked to edit the default config files, perhaps to resolve a bug, and the subsequent upgrade/migration will work properly.

In general, do not edit default/*.conf files.

View solution in original post

Jason
Motivator

The only time I have ever had to edit an etc/system/default/ file is before first run, if I want to change the default admin username and password for the system. This is in etc/system/default/user-seed.conf; Splunk does not appear to pay attention to the file if it exists in local.

In other words, I only supply a modified one of these files if I'm building a package that installs splunk, installs some custom config, then starts splunk for the first time.

0 Karma

Jason
Motivator

Also, this does not appear to work as of 4.3.x.

0 Karma

the_wolverine
Champion

It is very rare that Splunk Support will ever ask you to edit any default configuration files. The danger in doing this is that a subsequent upgrade or migration will overwrite your configuration and cause Splunk to break.

There may be rare occasions where you will be asked to edit the default config files, perhaps to resolve a bug, and the subsequent upgrade/migration will work properly.

In general, do not edit default/*.conf files.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...