The best policy is that the AUTHOR of the app puts it into default and everyone else writes into local. When you download an app from apps.splunk.com you will find that all of the author's stuff is in default and nothing is in local and when you deploy these apps from your DS, you should not modify this. Also, when you write your own proprietary apps that are for internal use only, when you put them on the DS, they should use default, not local. So the general rule is that if it is on the DS, it should be using default UNLESS you are making a modification to something that is distributed with the base Splunk distribution (e.g. '$SPLUNK_HOME/etc/system//.conf); in that case you make your proprietary changes inside$SPLUNK_HOME/etc/system/local*.confand NEVER touch anything inside anydefault` directory that came from your original installation of Splunk binaries.
