Which folders under $SPLUNK_HOME/etc get written over during a Splunk Enterprise upgrade?

[rholm01]

Which folders under $SPLUNK_HOME/etc get written over during a Splunk Enterprise upgrade? I am able to find the files under $SPLUNK_HOME/etc but those only show the .conf files, and I know that there are dashboards, saved searches, and views in XML files that can get walked over if they are not in a "safe" folder.

This is what I use to find the files with the note regarding losing files on updates:

find . -type f -exec grep -H "Changes to default files will be lost on update" 2> /dev/null {} \;

[woodcock · Accepted solution]

You can run this command to see what is in the new splunk file:

tar tvf ./splunk*tgz | grep "splunk/etc/"

You can run this command to see what came from the current version:

grep "splunk/etc/" $(ls -altr /opt/splunk/splunk*manifest | tail -1 | awk '{print $NF}')

[richgalloway]

Not all of the files that could be touched during an update have a warning comment in them.

In general, any file in a 'local' directory ($SPLUNK_HOME/etc/system/local/, $SPLUNK_HOME/etc/apps//local/*) are safe. Also safe are all files in apps you created and those in directories ("myauth" for your certificates, for example) you created. Third-party apps are also safe until they are upgraded.

[skoelpin]

CONF files will usually live under /opt/splunk/etc/apps/<App-NAME>/

You will see default, local, web etc.. which is where the conf files live. When upgrading, all conf files under default will be updated while local conf files will remain untouched