Getting Data In

Do you use Local or Default directories for your data inputs?

Jarohnimo
Builder

Always place your edits in local directors.  (Removed the question because it was confusing)

Labels (2)
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

This is where best practices come into play. Typically, any app you write, once you push / deploy it, all your configs should be default. If you have to modify the app on a per host basis you can put these changes in local ( although with a DS, this will still get deleted.)

The key thing here is that default is used to denote the 'default' configurations of the app. Local should be used to for local configurations that are modified outside of the default state of the configuration.

View solution in original post

ddrillic
Ultra Champion

It's funny as I saw this exact scenario of an _server_app_eng_webservers app in the Splunk Admin class this week.

The UI created the inputs.conf under local in one of the labs -
SPLUNK_HOME/etc/deployment-apps/_server_app_eng_webservers/local/inputs.conf.

But look, when I create my own manual inputs.conf for my deployment-apps, I do it under the local directory.

I think the issue relates to the scalability of the app - if we create a generic app which can be modified and extended, then default makes sense. If, on the other hand, it's about an app with very specific use, then there is no point for the default location.

0 Karma

Jarohnimo
Builder

Thank you for this info. What's Strange is when you use DS gui it places the configuration into the local instead of default. Whereas if you manually create your app you will have place your conf into default.

Is there a purpose or a reason for splunk doing this or perhaps an enhancement they need to consider when using the web browser to create and deploy apps

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

This is where best practices come into play. Typically, any app you write, once you push / deploy it, all your configs should be default. If you have to modify the app on a per host basis you can put these changes in local ( although with a DS, this will still get deleted.)

The key thing here is that default is used to denote the 'default' configurations of the app. Local should be used to for local configurations that are modified outside of the default state of the configuration.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...