Splunk configuration methods
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Splunk configuration methods
Splunk maintains its configuration information in a set of configuration files. You can configure Splunk by using any of these methods:
- Editing configuration files directly.
- Filling out fields in Splunk Manager in Splunk Web.
- Specifying Splunk CLI commands.
All of these methods change the contents of the underlying configuration files.
To configure and manage distributed environments, you can use Splunk's deployment server.
Configuration files
Most of Splunk's configuration information is stored in .conf files. These files are located under your Splunk installation directory (usually referred to in the documentation as $SPLUNK_HOME) under /etc/system. You can make changes to these files using a standard text editor. Before you begin editing configuration files, read the material in the topic called About configuration files.
Splunk Manager
You can perform most common configuration tasks with Splunk Manager in Splunk Web. Splunk Web runs by default on port 8000 of the host on which it is installed:
- If you're running Splunk on your local machine, the URL to access Splunk Web is http://localhost:8000.
- If you're running Splunk on a remote machine, the URL to access Splunk Web is http://<hostname>:8000,
where <hostname> is the name of the machine Splunk is running on.
To access Splunk Manager, log into Splunk Web and click Manager in the upper right hand corner.
Splunk CLI
Many configuration options are available via the CLI. These options are documented in their respective topics, or you can get a complete CLI help reference with the command help while Splunk is running:
./splunk help
For more information about the CLI, refer to "About the CLI" in this manual.
Managing a distributed environment
The Splunk deployment server provides centralized management and configuration for distributed environments. You can use it to deploy sets of configuration files or other content to groups of Splunk instances across the enterprise.
For information about managing deployments, refer to "Deploy to other Splunk instances" in this manual.
Restarting after configuration changes
Many changes to configuration files require you to restart Splunk. Check the configuration file or its reference topic to see whether a particular change requires a restart.
When you make changes in the Manager, the Manager will let you know if you have to restart.
These changes require additional or different actions before they will take effect:
- Enable configuration changes made to
transforms.confby typing the following search in Splunk Web:
| extract reload=T- Reload
authentication.confvia the Manager > Authentication section of Splunk Web. This refreshes the authentication caches, but does not disconnect current users.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.