Admin Manual

Splunk configuration methods

Splunk maintains its configuration information in a set of configuration files. You can configure Splunk by using any of these methods:

• Editing configuration files directly.
• Filling out fields in Splunk Manager in Splunk Web.
• Specifying Splunk CLI commands.
• App setup screens that use the Splunk REST API to update configurations.

All of these methods change the contents of the underlying configuration files.

To configure and manage distributed environments, you can use Splunk's deployment server.

Configuration files

Most of Splunk's configuration information is stored in .conf files. These files are located under your Splunk installation directory (usually referred to in the documentation as $SPLUNK_HOME) under /etc/system. You can make changes to these files using a standard text editor. Before you begin editing configuration files, read "About configuration files".

Splunk Manager

You can perform most common configuration tasks with Splunk Manager in Splunk Web. Splunk Web runs by default on port 8000 of the host on which it is installed:

• If you're running Splunk on your local machine, the URL to access Splunk Web is http://localhost:8000.
• If you're running Splunk on a remote machine, the URL to access Splunk Web is http://<hostname>:8000, where <hostname> is the name of the machine Splunk is running on.

To access Splunk Manager, log into Splunk Web and click Manager in the upper right hand corner.

Splunk CLI

Many configuration options are available via the CLI. These options are documented in their respective topics, or you can get a complete CLI help reference with the command help while Splunk is running:

./splunk help

For more information about the CLI, refer to "About the CLI" in this manual.

Setup screens for an app

Developers can create setup screens for an app that allow users to set configurations for their app without having to edit the configuration files directly. Setup screens make it easier to distribute apps to different environments, or to customize an app for a particular usage.

Setup screens use Splunk's REST API to manage the app's configuration files.

For more information about setup screens, refer to "Configure a setup screen for your app" in the Developing Views and Apps for Splunk Web manual.

Managing a distributed environment

The Splunk deployment server provides centralized management and configuration for distributed environments. You can use it to deploy sets of configuration files or other content to groups of Splunk instances across the enterprise.

For information about managing deployments, refer to "Deploy to other Splunk instances".

Restarting after configuration changes

Many changes to configuration files require you to restart Splunk. Check the configuration file or its reference topic to see whether a particular change requires a restart.

When you make changes in Manager, it will let you know if you have to restart.

These changes require additional or different actions before they will take effect:

• Enable configuration changes made to props.conf or transforms.conf by typing the following search in Splunk Web:

| extract reload=T

• To reload authentication.conf, use Splunk Web. Go to Manager > Access controls > Authentication method and click the Reload authentication configuration button. This refreshes the authentication caches, but does not disconnect current users.