Security

Where in the system directories and files do I find changes made in the Splunk Web UI?

horsefez
Motivator

Hi,
I'm using Splunk on a linux-machine and accessing it successfully through the Splunk Web UI.
Today I've added a new user.

In which directory on the system will the changes be written to?
Which directory leads to the file where the configuration of the new user is set?
Do I have to restart any service before the changes are displayed?

Thanks in advance!

0 Karma
1 Solution

chanfoli
Builder

Normally when you install splunk enterprise $SPLUNK_HOME is defined as /opt/splunk, most splunkweb config changes end up in various conf files under $SPLUNK_HOME/etc/system/local or $SPLUNK_HOME/etc/apps/SOMEAPPNAME/local depending on the context of the changes. Splunk native authentication configuration is a bit of a special case, you can see some info on this here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Usernameprecedence

You can also see some detail on general config precedence rules here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Wheretofindtheconfigurationfiles

Generally configurations are saved and loaded dynamically when made through splunkweb and it should tell you if a service restart is required when you commit a particular change.

View solution in original post

chanfoli
Builder

Normally when you install splunk enterprise $SPLUNK_HOME is defined as /opt/splunk, most splunkweb config changes end up in various conf files under $SPLUNK_HOME/etc/system/local or $SPLUNK_HOME/etc/apps/SOMEAPPNAME/local depending on the context of the changes. Splunk native authentication configuration is a bit of a special case, you can see some info on this here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Usernameprecedence

You can also see some detail on general config precedence rules here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Wheretofindtheconfigurationfiles

Generally configurations are saved and loaded dynamically when made through splunkweb and it should tell you if a service restart is required when you commit a particular change.

horsefez
Motivator

Thank you! 🙂

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...