Where do I put the outputs.conf file to disable indexing on my search head?

[fisuser1]

Where do I put the outputs.conf file to disable indexing on my search head? Does this go in /splunk/etc/system/local or in one of the apps on the SH?

[tcpout]
defaultGroup = primary_indexer

[tcpout:primary_indexer]
server = ##.##.###.##:9997

[mrgibbon · Accepted solution]

Personally I would create a deployment app and push it out where needed.
But if you are only running one machine, you can put it in either place you mention, just be aware in /system/local/ it will overrule anything in the /apps/myapp/local folders.

Cheers

[fisuser1]

Forgot to include this in my original.

[indexAndForward]
index = false