About configuration files

Splunk Enterprise configuration settings are stored in configuration files. These files are identified by the .conf extension. Types of configuration settings include:

• System settings
• Authentication and authorization information
• Index-related settings
• Deployment and cluster configurations
• Knowledge objects and saved searches

For a list of configuration files and an overview of the area that each file covers, see List of configuration files in this manual.

Default configuration files are stored in the $SPLUNK_HOME/etc/system/default/ directory.

Use Splunk Web to manage configuration files

When you change your configuration in Splunk Web, that change is written to a copy of the configuration file for that setting. Splunk software creates a copy of this configuration file (if it does not exist), writes the change to that copy, and adds it to a directory under $SPLUNK_HOME/etc/.... The directory that the new file is added to depends on a number of factors that are discussed in Configuration file directories in this manual. The most common directory is $SPLUNK_HOME/etc/system/local, which is used in the example.

If you add a new index in Splunk Web, the software performs the following actions:

1. Checks for a copy of the file.

2. If no copy exists, the software creates a copy of indexes.conf and adds it to a directory, such as $SPLUNK_HOME/etc/system/local.

3. Writes the change to the copy of indexes.conf.

4. Leaves the default file unchanged in $SPLUNK_HOME/etc/system/default.

Edit the configuration file settings directly

While you can perform a lot of configuration with Splunk Web or CLI commands, you can also edit the configuration files directly. Some advanced configurations are not exposed in Splunk Web or the CLI and can only be changed by editing the configuration files directly.

Never change, copy, or move the configuration files that are in the default directory. Default files must remain intact and in their original location. When you upgrade your Splunk software, the default directory is overwritten. Any changes that you make in the default directory are lost when you upgrade to a newer version of the software. Changes that you make in non-default configuration directories persist when you upgrade.

To change settings for a particular configuration file, you must first create a new version of the file in a non-default directory and then add the settings that you want to change. When you first create this new version of the file, start with an empty file. Do not start from a copy of the file in the default directory. For information on the directories where you can manually change configuration files, see Configuration file directories.

Before you change any configuration files:

• Learn about how the default configuration files work, and where to put the files that you edit. See Configuration file directories.
• Learn about the structure of the stanzas that comprise configuration files and how the attributes you want to edit are set up. See Configuration file structure.
• Learn how different versions of the same configuration files in different directories are layered and combined so that you know the best place to put your file. See Configuration file precedence.
• Consult the product documentation, including the .spec and .example files for the configuration file. These documentation files reside in the file system in $SPLUNK_HOME/etc/system/README, as well as in the last chapter of this manual.

After you are familiar with the configuration file content and directory structure, and understand how to leverage Splunk Enterprise configuration file precedence, see How to edit a configuration file to learn how to safely change your files.