Where in the system directories and files do I find changes made in the Splunk Web UI?

[horsefez]

Hi,
I'm using Splunk on a linux-machine and accessing it successfully through the Splunk Web UI.
Today I've added a new user.

In which directory on the system will the changes be written to?
Which directory leads to the file where the configuration of the new user is set?
Do I have to restart any service before the changes are displayed?

Thanks in advance!

[chanfoli · Accepted solution]

Normally when you install splunk enterprise $SPLUNK_HOME is defined as /opt/splunk, most splunkweb config changes end up in various conf files under $SPLUNK_HOME/etc/system/local or $SPLUNK_HOME/etc/apps/SOMEAPPNAME/local depending on the context of the changes. Splunk native authentication configuration is a bit of a special case, you can see some info on this here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Usernameprecedence

You can also see some detail on general config precedence rules here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Wheretofindtheconfigurationfiles

Generally configurations are saved and loaded dynamically when made through splunkweb and it should tell you if a service restart is required when you commit a particular change.

[horsefez]

Thank you! 🙂