- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Why is splunk-launch.conf not in system/local?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why is splunk-launch.conf not in system/local?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Because Splunk-launch.conf hold startup information, that is required to get the Splunk application started to the point it can read the other configuraiton files.
The settings for the SPLUNK_HOME and SPLUNK_DB variables are set in this file. How can it read the files in $SPLUNK_HOME/etc/apps if it doesnt know the value of SPLUNK_HOME?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Because Splunk-launch.conf hold startup information, that is required to get the Splunk application started to the point it can read the other configuraiton files.
The settings for the SPLUNK_HOME and SPLUNK_DB variables are set in this file. How can it read the files in $SPLUNK_HOME/etc/apps if it doesnt know the value of SPLUNK_HOME?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Note from splunk-launch.conf didn't help?
# Note: this conf file is different from most splunk conf files. There is
# only one in the whole system, located at
# $SPLUNK_HOME/etc/splunk-launch.conf; further, there are no stanzas,
# explicit or implicit. Finally, any splunk-launch.conf files in
# etc/apps/... or etc/users/... will be ignored.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yeah, but still curious as to why
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i think that because of the nature of the configurations this file holds, you really dont want any conflict or overwrite due to hierarchy.
even at system/local, it can be overwritten or conflicted by writing same file in an indexer cluster (slave-apps directory) or search head cluster (moves to the default directory when pushing bundle)
any conflicts in this file will cause pain ...
nothing above is supported in any docs (that i could find) just a guess
Infographic provides the TL;DR for the 2024 Splunk Career Impact Report
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
