- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Should I ever edit any configuration files in $SPL...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why shouldn't I edit any of the .../default/*.conf files?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It is very rare that Splunk Support will ever ask you to edit any default configuration files. The danger in doing this is that a subsequent upgrade or migration will overwrite your configuration and cause Splunk to break.
There may be rare occasions where you will be asked to edit the default config files, perhaps to resolve a bug, and the subsequent upgrade/migration will work properly.
In general, do not edit default/*.conf files.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The only time I have ever had to edit an etc/system/default/ file is before first run, if I want to change the default admin username and password for the system. This is in etc/system/default/user-seed.conf; Splunk does not appear to pay attention to the file if it exists in local.
In other words, I only supply a modified one of these files if I'm building a package that installs splunk, installs some custom config, then starts splunk for the first time.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also, this does not appear to work as of 4.3.x.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It is very rare that Splunk Support will ever ask you to edit any default configuration files. The danger in doing this is that a subsequent upgrade or migration will overwrite your configuration and cause Splunk to break.
There may be rare occasions where you will be asked to edit the default config files, perhaps to resolve a bug, and the subsequent upgrade/migration will work properly.
In general, do not edit default/*.conf files.
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
Detecting Remote Code Executions With the Splunk Threat Research Team
