$SPLUNK_HOME/etc/local/default use?

[JimDeich]

I have an app (Cloudpassage) that instructs to put a props.conf file in $SPLUNK_HOME/etc/local/default . I am not familiar with this dir and
cannot find much about it in documents. Does this have something to do with web interaction or modular inputs?

Plenty of somewhat similar dirs $SPLUNK_HOME/etc/system/local, $SPLUNK_HOME/etc/apps/appname/default,
$SPLUNK_HOME/etc/apps/appname/local ..

Non of our splunk install every have: $SPLUNK_HOME/etc/local .

Thanks!

[JimDeich]

All, I appreciate the general help, but I am looking for a specific answer for the directory :

$SPLUNK_HOME/etc/local/default use .

This is NOT $SPLUNK_HOME/etc/system/local/

[ChrisG]

It is important to understand how the configuration file directories work, where the active copies of the files go, and how precedence functions. See these documentation topics, they are fundamental to configuring Splunk software.

• About configuration files
• Configuration file directories
• Configuration file precedence

...and the topics that follow them in the Admin Manual.

[JimDeich]

Appreciated, but I need a specific answer for this directory and am NOT finding one. Do you know the purpose of this dir? This is not $SPLUNK_HOME/etc/system/local it is: $SPLUNK_HOME/etc/local . I am fairly familiar with most config dir.

[ChrisG]

Got it. I went and read the Cloudpassage doc page and I see exactly what you mean. That is a bit odd. I wonder if it's possible that their docs are wrong. Have you tried configuring it in /etc/system/local?

[JimDeich]

I'm starting to think it's a typo and maybe the mean /etc/system/local . Thanks for running to check on it.

[Lucas_K]

Its certainly a typo.