Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. Click here for the latest version.Download topic as PDF
The following are the spec and example files for
Version 7.3.5 This file documents the syntax of default-mode.conf for comprehension and troubleshooting purposes. default-mode.conf is a file that exists primarily for Splunk Support and Services to configure splunk. CAVEATS: DO NOT make changes to default-mode.conf without coordinating with Splunk Support or Services. End-user changes to default-mode.conf are not supported. default-mode.conf *will* be removed in a future version of Splunk, along with the entire configuration scheme that it affects. Any settings present in default-mode.conf files will be completely ignored at this point. Any number of seemingly reasonable configurations in default-mode.conf might fail to work, behave bizarrely, corrupt your data, iron your cat, cause unexpected rashes, or order unwanted food delivery to your house. Changes here alter the way that pieces of code will communicate which are only intended to be used in a specific configuration. INFORMATION: The main value of this spec file is to assist in reading these files for troubleshooting purposes. default-mode.conf was originally intended to provide a way to describe the alternate setups used by the Splunk Light Forwarder and Splunk Universal Forwarder. The only reasonable action is to re-enable input pipelines that are disabled by default in those forwarder configurations. However, keep the prior caveats in mind. Any future means of enabling inputs will have a different form when this mechanism is removed. SYNTAX:
disabled = true | false disabled_processors = <string>
* Refers to a particular Splunkd pipeline. * The set of named pipelines is a splunk-internal design. That does not mean that the Splunk design is a secret, but it means it is not external for the purposes of configuration. * Useful information on the data processing system of splunk can be found in the external documentation, for example http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Datapipeline disabled = true | false * If set to true on a specific pipeline, the pipeline will not be loaded in the system. disabled_processors = <processor1>, <processor2> * Processors which normally would be loaded in this pipeline are not loaded if they appear in this list * The set of named procoessors is again a splunk-internal design component.
Last modified on 17 March, 2020
This documentation applies to the following versions of Splunk® Enterprise: 7.3.5
Feedback submitted, thanks!