What config file defines where the output.csv file gets stored by default into $SPLUNK_HOME/var/run/splunk?
There is no configuration file that defines this setting. Splunk will always output the CSV to the same location.