Getting Data In

$SPLUNK_HOME/etc/local/default use?

JimDeich
Path Finder

I have an app (Cloudpassage) that instructs to put a props.conf file in $SPLUNK_HOME/etc/local/default . I am not familiar with this dir and
cannot find much about it in documents. Does this have something to do with web interaction or modular inputs?

Plenty of somewhat similar dirs $SPLUNK_HOME/etc/system/local, $SPLUNK_HOME/etc/apps/appname/default,
$SPLUNK_HOME/etc/apps/appname/local ..

Non of our splunk install every have: $SPLUNK_HOME/etc/local .

Thanks!

0 Karma

JimDeich
Path Finder

All, I appreciate the general help, but I am looking for a specific answer for the directory :

$SPLUNK_HOME/etc/local/default use .

This is NOT $SPLUNK_HOME/etc/system/local/

0 Karma

ChrisG
Splunk Employee
Splunk Employee

It is important to understand how the configuration file directories work, where the active copies of the files go, and how precedence functions. See these documentation topics, they are fundamental to configuring Splunk software.

...and the topics that follow them in the Admin Manual.

JimDeich
Path Finder

Appreciated, but I need a specific answer for this directory and am NOT finding one. Do you know the purpose of this dir? This is not $SPLUNK_HOME/etc/system/local it is: $SPLUNK_HOME/etc/local . I am fairly familiar with most config dir.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Got it. I went and read the Cloudpassage doc page and I see exactly what you mean. That is a bit odd. I wonder if it's possible that their docs are wrong. Have you tried configuring it in /etc/system/local?

0 Karma

JimDeich
Path Finder

I'm starting to think it's a typo and maybe the mean /etc/system/local . Thanks for running to check on it.

0 Karma

Lucas_K
Motivator

Its certainly a typo.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...