Splunk® Enterprise

Admin Manual

Acrobat logo Download manual as PDF

Splunk Enterprise version 7.1 is no longer supported as of October 31, 2020. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. Click here for the latest version.
Acrobat logo Download topic as PDF


The following are the spec and example files for literals.conf.


   Version 7.1.10

 This file contains attribute/value pairs for configuring externalized strings
 in literals.conf.

 There is a literals.conf in $SPLUNK_HOME/etc/system/default/.  To set custom
 configurations, place a literals.conf in $SPLUNK_HOME/etc/system/local/. For
 examples, see literals.conf.example. You must restart Splunk to enable

 To learn more about configuration files (including precedence) please see the
 documentation located at

 For the full list of all literals that can be overridden, check out


  - You can destroy Splunk's performance by editing literals.conf incorrectly.

  - Only edit the attribute values (on the right-hand side of the '=').
    DO NOT edit the attribute names (left-hand side of the '=').

  - When strings contain "%s", do not add or remove any occurrences of %s, or
    reorder their positions.

  - When strings contain HTML tags, take special care to make sure that all
    tags and quoted attributes are properly closed, and that all entities such
    as & are escaped.


#   Version 7.1.10
# This file contains an example literals.conf, which is used to
# configure the externalized strings in Splunk.
# For the full list of all literals that can be overwritten, consult
# the far longer list in $SPLUNK_HOME/etc/system/default/literals.conf

PRO_SERVER_LOGIN_HEADER = Login to Splunk (guest/guest)
INSUFFICIENT_DISK_SPACE_ERROR = The server's free disk space is too low.  Indexing will temporarily pause until more disk space becomes available.
SERVER_RESTART_MESSAGE = This Splunk Server's configuration has been changed.  The server needs to be restarted by an administrator.
UNABLE_TO_CONNECT_MESSAGE = Could not connect to splunkd at %s.

Last modified on 12 December, 2019

This documentation applies to the following versions of Splunk® Enterprise: 7.1.10

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters