Why shouldn't I edit any of the .../default/*.conf files?
It is very rare that Splunk Support will ever ask you to edit any default configuration files. The danger in doing this is that a subsequent upgrade or migration will overwrite your configuration and cause Splunk to break.
There may be rare occasions where you will be asked to edit the default config files, perhaps to resolve a bug, and the subsequent upgrade/migration will work properly.
In general, do not edit default/*.conf files.
The only time I have ever had to edit an etc/system/default/ file is before first run, if I want to change the default admin username and password for the system. This is in etc/system/default/user-seed.conf; Splunk does not appear to pay attention to the file if it exists in local.
In other words, I only supply a modified one of these files if I'm building a package that installs splunk, installs some custom config, then starts splunk for the first time.
Also, this does not appear to work as of 4.3.x.
It is very rare that Splunk Support will ever ask you to edit any default configuration files. The danger in doing this is that a subsequent upgrade or migration will overwrite your configuration and cause Splunk to break.
There may be rare occasions where you will be asked to edit the default config files, perhaps to resolve a bug, and the subsequent upgrade/migration will work properly.
In general, do not edit default/*.conf files.