Getting Data In

Why is splunk-launch.conf not in system/local?

nick405060
Motivator

Why is splunk-launch.conf not in system/local?

0 Karma
1 Solution

solarboyz1
Builder

Because Splunk-launch.conf hold startup information, that is required to get the Splunk application started to the point it can read the other configuraiton files.

The settings for the SPLUNK_HOME and SPLUNK_DB variables are set in this file. How can it read the files in $SPLUNK_HOME/etc/apps if it doesnt know the value of SPLUNK_HOME?

View solution in original post

solarboyz1
Builder

Because Splunk-launch.conf hold startup information, that is required to get the Splunk application started to the point it can read the other configuraiton files.

The settings for the SPLUNK_HOME and SPLUNK_DB variables are set in this file. How can it read the files in $SPLUNK_HOME/etc/apps if it doesnt know the value of SPLUNK_HOME?

jawaharas
Motivator

Note from splunk-launch.conf didn't help?

# Note: this conf file is different from most splunk conf files.  There is
# only one in the whole system, located at
# $SPLUNK_HOME/etc/splunk-launch.conf; further, there are no stanzas,
# explicit or implicit.  Finally, any splunk-launch.conf files in
# etc/apps/... or etc/users/... will be ignored.
0 Karma

nick405060
Motivator

yeah, but still curious as to why

0 Karma

adonio
Ultra Champion

i think that because of the nature of the configurations this file holds, you really dont want any conflict or overwrite due to hierarchy.
even at system/local, it can be overwritten or conflicted by writing same file in an indexer cluster (slave-apps directory) or search head cluster (moves to the default directory when pushing bundle)
any conflicts in this file will cause pain ...
nothing above is supported in any docs (that i could find) just a guess

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...