Getting Data In
Highlighted

$SPLUNK_HOME/etc/local/default use?

Path Finder

I have an app (Cloudpassage) that instructs to put a props.conf file in $SPLUNK_HOME/etc/local/default . I am not familiar with this dir and
cannot find much about it in documents. Does this have something to do with web interaction or modular inputs?

Plenty of somewhat similar dirs $SPLUNKHOME/etc/system/local, $SPLUNKHOME/etc/apps/appname/default,
$SPLUNK_HOME/etc/apps/appname/local ..

Non of our splunk install every have: $SPLUNK_HOME/etc/local .

Thanks!

0 Karma
Highlighted

Re: $SPLUNK_HOME/etc/local/default use?

Splunk Employee
Splunk Employee

It is important to understand how the configuration file directories work, where the active copies of the files go, and how precedence functions. See these documentation topics, they are fundamental to configuring Splunk software.

...and the topics that follow them in the Admin Manual.

Highlighted

Re: $SPLUNK_HOME/etc/local/default use?

Path Finder

Appreciated, but I need a specific answer for this directory and am NOT finding one. Do you know the purpose of this dir? This is not $SPLUNKHOME/etc/system/local it is: $SPLUNKHOME/etc/local . I am fairly familiar with most config dir.

0 Karma
Highlighted

Re: $SPLUNK_HOME/etc/local/default use?

Splunk Employee
Splunk Employee

Got it. I went and read the Cloudpassage doc page and I see exactly what you mean. That is a bit odd. I wonder if it's possible that their docs are wrong. Have you tried configuring it in /etc/system/local?

0 Karma
Highlighted

Re: $SPLUNK_HOME/etc/local/default use?

Path Finder

I'm starting to think it's a typo and maybe the mean /etc/system/local . Thanks for running to check on it.

0 Karma
Highlighted

Re: $SPLUNK_HOME/etc/local/default use?

Motivator

Its certainly a typo.

0 Karma
Highlighted

Re: $SPLUNK_HOME/etc/local/default use?

Path Finder

All, I appreciate the general help, but I am looking for a specific answer for the directory :

$SPLUNK_HOME/etc/local/default use .

This is NOT $SPLUNK_HOME/etc/system/local/

0 Karma