How to Prevent /lib folder of an app to be overridden?

[GaetanVP]

Hello Splunkers,

I would like to know if it's possible to prevent /lib path of a Splunk app to be overridden after an upgrade of this app.

For instance, I edited the cacert.pem file in the following path

/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/certifi/cacert.pem

 And after the upgrade of the Splunk_TA_microsoft-cloudservices app, the cacert.pem has been replaced during the upgrade.

Would it be possible to avoid that ?

Regards,

GaetanVP  

[SplunkExplorer]

I confirm @richgalloway words. Local folders are designed to enable custom change without risks of update overrides; this help also to avoid custom/manual change in default folders, that shouldn't be changed as it's not a Splunk best pratice.

[richgalloway · Accepted solution]

If you move the cert to the local directory then it won't be overwritten during an upgrade.

/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/cacert.pem