Best way to deploy new limits.conf on Windows universal forwarder?

[Ulfb]

Hi,

We have Splunk 6 with Deployment server.

I'm trying to understand how to best deploy limits.conf with an app.

I note that when Splunk Uni Fwd are deployed to an windows host it's get here:

C:\Program Files\SplunkUniversalForwarder\bin>splunk  cmd btool limits list thruput --debug
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\limits.conf [thruput]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\limits.conf maxKBps = 256

An app won't override this, so do I need to delete "C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\limits.conf" to be able to use an deployable app ?

How do others solve this ?

[gkanapathy · Accepted solution]

An app will override this just fine. Settings in any "local" conf folder will override settings in any "default" folder.

[Ulfb]

Thanks.

It working using an lover Letter as app name.

[aaronkorn]

limits.conf requires a restart for the changes to take hold http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/limitsconf

If you place limits.conf in the local directory of any deployment app and have restartSplunkd = true for your particular serverclass in serverclass.conf you should be set.