UF directories structure

[splunkreal]

Hello,

On UF I've seen that we put pem certificates in etc/apps/myapp/default/data
On our servers however I've seen something like etc/apps/myapp/data

Are there rules or both are ok? (they are working but are they best practices?)

Thanks!

[PickleRick]

Well, for certificates, to which you have to point Splunk explicitly, it doesn't matter much. The "default" directory is important for Splunk config files due to rules regarding building effective config, file preferences and all that but whether a pem file is placed here or there doesn't matter as long as it's readable.

One caveat - it could matter if you were pushing it to SHs from the deployer because different push modes can result in different app contents.

[isoutamo]

My habit it to use .../myapps/certs directory for those. And then point to correct files in needed e.g. servers.conf or outputs.conf in default and/or local directory based on is those my own apps or someones else.