Splunk® Enterprise

Admin Manual

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF


The following are the spec and example files for default-mode.conf.


# This file documents, for comprehension and troubleshooting purposes
# the syntax of default-mode.conf.

# Primarily, default-mode.conf is a file that exists for Splunk Inc. to configure 
# splunk.


# DO NOT make changes to default-mode.conf without coordinating with Splunk Inc.

# End-user changes to default-mode.conf are not supported.
# default-mode.conf *will* be removed in future versions of splunk, along with
# the entire configuration scheme that it affects. Any settings present in such
# files will be completely ignored at this point.
# Any number of seemingly reasonable configurations that might be constructable
# in these files will not work, behave bizarrely, corrupt your data, iron your
# cat, cause unexpected rashes, or order unwanted food delivery to your house.
# This is because changes here alter the way that pieces of code will
# communicate which are only intended to be used in a specific configuration.


# The main value of this spec file is to assist in reading these files for
# troubleshooting purposes.

# The primary purpose of default-mode.conf was to provide a way to describe
# the alternate setups used by the Splunk Light Forwarder and Splunk Universal
# Forwarder.

# The only reasonable action is to re-enable input pipelines that are disabled by
# default in those forwarder configurations, however keep the prior caveats in
# mind.  Any future means of enabling inputs will have a different form when this
# mechanism is removed.


disabled = true | false
disabled_processors = <string>

 * Refers to a particular Splunkd pipeline.
 * The set of named pipelines is a splunk-internal design.  That does not mean
   that the Splunk design is a secret, but it means it is not external for the
   purposes of configuration.
 * Useful information on the data processing system of splunk can be found in
   the external documentation, for example

disabled = true | false
 * If set to true on a specific pipeline, the pipeline will not be loaded in
   the system.

disabled_processors = <processor1>, <processor2>
 * Processors which normally would be loaded in this pipeline are not loaded if
   they appear in this list
 * The set of named procoessors is again a splunk-internal design component.


No example

This documentation applies to the following versions of Splunk® Enterprise: 5.0.4

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters