Getting Data In

Do you use Local or Default directories for your data inputs?

Jarohnimo
Builder

Always place your edits in local directors.  (Removed the question because it was confusing)

Labels (2)
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

This is where best practices come into play. Typically, any app you write, once you push / deploy it, all your configs should be default. If you have to modify the app on a per host basis you can put these changes in local ( although with a DS, this will still get deleted.)

The key thing here is that default is used to denote the 'default' configurations of the app. Local should be used to for local configurations that are modified outside of the default state of the configuration.

View solution in original post

ddrillic
Ultra Champion

It's funny as I saw this exact scenario of an _server_app_eng_webservers app in the Splunk Admin class this week.

The UI created the inputs.conf under local in one of the labs -
SPLUNK_HOME/etc/deployment-apps/_server_app_eng_webservers/local/inputs.conf.

But look, when I create my own manual inputs.conf for my deployment-apps, I do it under the local directory.

I think the issue relates to the scalability of the app - if we create a generic app which can be modified and extended, then default makes sense. If, on the other hand, it's about an app with very specific use, then there is no point for the default location.

0 Karma

Jarohnimo
Builder

Thank you for this info. What's Strange is when you use DS gui it places the configuration into the local instead of default. Whereas if you manually create your app you will have place your conf into default.

Is there a purpose or a reason for splunk doing this or perhaps an enhancement they need to consider when using the web browser to create and deploy apps

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

This is where best practices come into play. Typically, any app you write, once you push / deploy it, all your configs should be default. If you have to modify the app on a per host basis you can put these changes in local ( although with a DS, this will still get deleted.)

The key thing here is that default is used to denote the 'default' configurations of the app. Local should be used to for local configurations that are modified outside of the default state of the configuration.

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...