Dashboards & Visualizations

Should I ever edit any configuration files in $SPLUNK_HOME/etc/*/default/ ?

Champion

Why shouldn't I edit any of the .../default/*.conf files?

1 Solution

Champion

It is very rare that Splunk Support will ever ask you to edit any default configuration files. The danger in doing this is that a subsequent upgrade or migration will overwrite your configuration and cause Splunk to break.

There may be rare occasions where you will be asked to edit the default config files, perhaps to resolve a bug, and the subsequent upgrade/migration will work properly.

In general, do not edit default/*.conf files.

View solution in original post

Motivator

The only time I have ever had to edit an etc/system/default/ file is before first run, if I want to change the default admin username and password for the system. This is in etc/system/default/user-seed.conf; Splunk does not appear to pay attention to the file if it exists in local.

In other words, I only supply a modified one of these files if I'm building a package that installs splunk, installs some custom config, then starts splunk for the first time.

0 Karma

Motivator

Also, this does not appear to work as of 4.3.x.

0 Karma

Champion

It is very rare that Splunk Support will ever ask you to edit any default configuration files. The danger in doing this is that a subsequent upgrade or migration will overwrite your configuration and cause Splunk to break.

There may be rare occasions where you will be asked to edit the default config files, perhaps to resolve a bug, and the subsequent upgrade/migration will work properly.

In general, do not edit default/*.conf files.

View solution in original post