List of configuration files
The following is a list of some of the available spec and example files associated with each conf file. Some conf files do not have spec or example files; contact Support before editing a conf file that does not have an accompanying spec or example file.
Caution: Do not edit the default copy of any conf file in $SPLUNK_HOME/etc/system/default/
. See How to edit a configuration file.
File | Purpose |
alert_actions.conf | Create an alert. |
app.conf | Configure app properties |
audit.conf | Configure auditing and event hashing. This feature is not available for this release. |
authentication.conf | Toggle between Splunk's built-in authentication or LDAP, and configure LDAP. |
authorize.conf | Configure roles, including granular access controls. |
checklist.conf | Customize monitoring console health check. |
collections.conf | Configure KV Store collections for apps. |
commands.conf | Connect search commands to any custom search script. |
datamodels.conf | Attribute/value pairs for configuring data models. |
default.meta.conf | Set permissions for objects in a Splunk app. |
deploymentclient.conf | Specify behavior for clients of the deployment server. |
distsearch.conf | Specify behavior for distributed search. |
event_renderers.conf | Configure event-rendering properties. |
eventtypes.conf | Create event type definitions. |
fields.conf | Create multivalue fields and add search capability for indexed fields. |
indexes.conf | Manage and configure index settings. |
inputs.conf | Set up data inputs. |
instance.cfg.conf | Designate and manage settings for specific instances of Splunk. This can be handy, for example, when identifying forwarders for internal searches. |
limits.conf | Set various limits (such as maximum result size or concurrent real-time searches) for search commands. |
literals.conf | Customize the text, such as search error strings, displayed in Splunk Web. |
macros.conf | Define search macros in Settings. |
messages.conf | |
multikv.conf | Configure extraction rules for table-like events (ps, netstat, ls). |
outputs.conf | Set up forwarding behavior. |
passwords.conf | Maintain the credential information for an app. |
procmon-filters.conf | Monitor Windows process data. |
props.conf | Set indexing property configurations, including timezone offset, custom source type rules, and pattern collision priorities. Also, map transforms to event properties. |
pubsub.conf | Define a custom client of the deployment server. |
restmap.conf | Create custom REST endpoints. |
savedsearches.conf | Define ordinary reports, scheduled reports, and alerts. |
searchbnf.conf | Configure the search assistant. |
segmenters.conf | Configure segmentation. |
server.conf | Enable SSL for Splunk's back-end (communications between Splunkd and Splunk Web) and specify certification locations. |
serverclass.conf | Define deployment server classes for use with deployment server. |
serverclass.seed.xml.conf | Configure how to seed a deployment client with apps at start-up time. |
source-classifier.conf | Terms to ignore (such as sensitive data) when creating a source type. |
sourcetypes.conf | Machine-generated file that stores source type learning rules. |
tags.conf | Configure tags for fields. |
telemetry.conf | Enable apps to collect telemetry data about app usage and other properties. |
times.conf | Define custom time ranges for use in the Search app. |
transactiontypes.conf | Add additional transaction types for transaction search. |
transforms.conf | Configure regex transformations to perform on data inputs. Use in tandem with props.conf. |
ui-prefs.conf | Change UI preferences for a view. Includes changing the default earliest and latest values for the time range picker. |
user-seed.conf | Set a default user and password. |
visualizations.conf | List the visualizations that an app makes available to the system. |
viewstates.conf | Use this file to set up UI views (such as charts). |
web.conf | Configure Splunk Web, enable HTTPS. |
wmi.conf | Set up Windows management instrumentation (WMI) inputs. |
workflow_actions.conf | Configure workflow actions. |
When to restart Splunk Enterprise after a configuration file change | Configuration parameters and the data pipeline |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13
Feedback submitted, thanks!