Getting Data In

Do you use Local or Default directories for your data inputs?

Jarohnimo
Builder

Always place your edits in local directors.  (Removed the question because it was confusing)

Labels (2)
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

This is where best practices come into play. Typically, any app you write, once you push / deploy it, all your configs should be default. If you have to modify the app on a per host basis you can put these changes in local ( although with a DS, this will still get deleted.)

The key thing here is that default is used to denote the 'default' configurations of the app. Local should be used to for local configurations that are modified outside of the default state of the configuration.

View solution in original post

ddrillic
Ultra Champion

It's funny as I saw this exact scenario of an _server_app_eng_webservers app in the Splunk Admin class this week.

The UI created the inputs.conf under local in one of the labs -
SPLUNK_HOME/etc/deployment-apps/_server_app_eng_webservers/local/inputs.conf.

But look, when I create my own manual inputs.conf for my deployment-apps, I do it under the local directory.

I think the issue relates to the scalability of the app - if we create a generic app which can be modified and extended, then default makes sense. If, on the other hand, it's about an app with very specific use, then there is no point for the default location.

0 Karma

Jarohnimo
Builder

Thank you for this info. What's Strange is when you use DS gui it places the configuration into the local instead of default. Whereas if you manually create your app you will have place your conf into default.

Is there a purpose or a reason for splunk doing this or perhaps an enhancement they need to consider when using the web browser to create and deploy apps

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

This is where best practices come into play. Typically, any app you write, once you push / deploy it, all your configs should be default. If you have to modify the app on a per host basis you can put these changes in local ( although with a DS, this will still get deleted.)

The key thing here is that default is used to denote the 'default' configurations of the app. Local should be used to for local configurations that are modified outside of the default state of the configuration.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.