I'm surprised that no one also noted that local/site changes should not be made to default files. One should make changes to the appropriate .../local/<conffile> so they are not overwritten if and when Splunk is upgraded. ... View more