This is a very old thread. You can get more visibiliy by starting a new one instead. But to the point - all those files are relevant. Splunk builds a single configuration version from various files in its directories according to precedence rules - https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Wheretofindtheconfigurationfiles   ... View more

  Using a default.yml got me past this hurdle. Thanks folks.   ... View more

  My mistake. It wasn't /opt/splunk/etc/splunk-launch.conf It was /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf The file content described was correct though.   ... View more

btw. here is an example for docker-compose using direct filesystem mapping version: '3' services: single: image: splunk/splunk:8.1.5 ports: - "8111:8000" volumes: - single-etc:/opt/splunk/etc - single-var:/opt/splunk/var - /my/path/to/indexapp/indexapp:/opt/splunk/etc/apps/indexapp hostname: idx1 environment: - SPLUNK_HOME=/opt/splunk/ # - DEFAULTS_URL=http://splunk-defaults/default.yml - SPLUNK_START_ARGS="--accept-license" - SPLUNK_PASSWORD=EnterYourCreditCardNumber - SPLUNK_ROLE=splunk_standalone - SPLUNK_DEBUG="true" volumes: single-etc: single-var: networks: default: external: name: splunk   regards,   Andreas ... View more