Do you use Local or Default directories for your data inputs?

[Jarohnimo]

Always place your edits in local directors.  (Removed the question because it was confusing)

[ddrillic]

It's funny as I saw this exact scenario of an _server_app_eng_webservers app in the Splunk Admin class this week.

The UI created the inputs.conf under local in one of the labs -
SPLUNK_HOME/etc/deployment-apps/_server_app_eng_webservers/local/inputs.conf.

But look, when I create my own manual inputs.conf for my deployment-apps, I do it under the local directory.

I think the issue relates to the scalability of the app - if we create a generic app which can be modified and extended, then default makes sense. If, on the other hand, it's about an app with very specific use, then there is no point for the default location.

[Jarohnimo]

Thank you for this info. What's Strange is when you use DS gui it places the configuration into the local instead of default. Whereas if you manually create your app you will have place your conf into default.

Is there a purpose or a reason for splunk doing this or perhaps an enhancement they need to consider when using the web browser to create and deploy apps

[esix_splunk · Accepted solution]

This is where best practices come into play. Typically, any app you write, once you push / deploy it, all your configs should be default. If you have to modify the app on a per host basis you can put these changes in local ( although with a DS, this will still get deleted.)

The key thing here is that default is used to denote the 'default' configurations of the app. Local should be used to for local configurations that are modified outside of the default state of the configuration.