
About configuration files
Splunk Enterprise configuration settings are stored in configuration files. These files are identified by the .conf
extension. Types of configuration settings include:
- System settings
- Authentication and authorization information
- Index-related settings
- Deployment and cluster configurations
- Knowledge objects and saved searches
For a list of configuration files and an overview of the area that each file covers, see List of configuration files in this manual.
Default configuration files are stored in the $SPLUNK_HOME/etc/system/default/
directory.
Use Splunk Web to manage configuration files
When you change your configuration in Splunk Web, that change is written to a copy of the configuration file for that setting. Splunk software creates a copy of this configuration file (if it does not exist), writes the change to that copy, and adds it to a directory under $SPLUNK_HOME/etc/...
. The directory that the new file is added to depends on a number of factors that are discussed in Configuration file directories in this manual. The most common directory is $SPLUNK_HOME/etc/system/local
, which is used in the example.
If you add a new index in Splunk Web, the software performs the following actions:
1. Checks for a copy of the file.
2. If no copy exists, the software creates a copy of indexes.conf
and adds it to a directory, such as $SPLUNK_HOME/etc/system/local
.
3. Writes the change to the copy of indexes.conf
.
4. Leaves the default file unchanged in $SPLUNK_HOME/etc/system/default
.
Edit the configuration file settings directly
While you can perform a lot of configuration with Splunk Web or CLI commands, you can also edit the configuration files directly. Some advanced configurations are not exposed in Splunk Web or the CLI and can only be changed by editing the configuration files directly.
Important: Never change, copy, or move the configuration files that are in the default directory. Default files must remain intact and in their original location. To change settings for a particular configuration file, you must first create a new version of the file in a non-default directory and then add the settings that you want to change. When you first create this new version of the file, start with an empty file. Do not start from a copy of the file in the default directory. For information on the directories where you can manually change configuration files, see Configuration file directories.
Before you change any configuration files:
- Learn about how the default configuration files work, and where to put the files that you edit. See Configuration file directories.
- Learn about the structure of the stanzas that comprise configuration files and how the attributes you want to edit are set up. See Configuration file structure.
- Learn how different versions of the same configuration files in different directories are layered and combined so that you know the best place to put your file. See Configuration file precedence.
- Consult the product documentation, including the .spec and .example files for the configuration file. These documentation files reside in the file system in
$SPLUNK_HOME/etc/system/README
, as well as in the last chapter of this manual.
After you are familiar with the configuration file content and directory structure, and understand how to leverage Splunk Enterprise configuration file precedence, see How to edit a configuration file to learn how to safely change your files.
PREVIOUS Customize Splunk Web messages |
NEXT Configuration file directories |
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 8.0.0
Comments
Addendum to my comment -- of course, what's written here is perfectly fine if the user never upgrades splunk ever. But as soon as there's a new splunk release the net effect of the fossilized default file now sitting in local is a big unknown and I've seen it cause both problems and confusion.
"Do not edit a default configuration file directly. Instead, create a copy and place it in a different directory, the same way Splunk Web does."
This is a super dangerous thing to tell users to make a copy of the entire default file, because now all those stanzas and keys they are copying will override default forever.
What the docs should say is basically "never edit default but instead just add just the stanzas and keys that you need to add/override, to the local file"
Arpoador, there are several topics in this manual specifically to help Windows customers. See http://docs.splunk.com/Documentation/Splunk/latest/Admin/IntroductionforWindowsadmins for information and navigation to the topics you need.
Just for fun, assume the user isn't using Linux. Update the doct't to indicate that for the two people using Splunk on Windows, we should look in "Program Files>Splunk>etc>system>local".<br />Sorry for being testy, but I'm running into a storm of poorly thought-out doct'n and it's consuming my whole day to get basic info as I stumble through stuff that should be easy. Eventually I'll learn it, but it won't be because of the Documentation.<br />Thanks. Dave. 650.678.1442
Sideview -
Thanks for alerting us to this issue. I've updated the material to address the problem.