I am using the deployment server and it has been my company's practice to put inputs.conf files in local. Is this where it belongs? It would seem that local would take precedence over default and is used to very specific site logging needs? Am I way off base here? Toto, is this Kansas 🙂
Thanks!
The best policy is that the AUTHOR of the app puts it into default
and everyone else writes into local
. When you download an app from apps.splunk.com
you will find that all of the author's stuff is in default
and nothing is in local
and when you deploy these apps from your DS, you should not modify this. Also, when you write your own proprietary apps that are for internal use only, when you put them on the DS, they should use default
, not local
. So the general rule is that if it is on the DS, it should be using default
UNLESS you are making a modification to something that is distributed with the base Splunk distribution (e.g. '$SPLUNK_HOME/etc/system//.conf); in that case you make your proprietary changes inside
$SPLUNK_HOME/etc/system/local*.confand NEVER touch anything inside any
default` directory that came from your original installation of Splunk binaries.