The following are the spec and example files for
Version 8.1.1 This file documents the syntax of default-mode.conf for comprehension and troubleshooting purposes. default-mode.conf is a file that exists primarily for Splunk Support and Services to configure the Splunk platform. CAVEATS: DO NOT make changes to default-mode.conf without coordinating with Splunk Support or Services. End-user changes to default-mode.conf are not supported. default-mode.conf *will* be removed in a future version of the Splunk platform, along with the entire configuration scheme that it affects. Any settings present in default-mode.conf files will be completely ignored at this point. Settings in default-mode.conf affect how pieces of code communicate. Configuration changes in default-mode.conf might fail to work, behave unexpectedly, or harm your deployment. Any changes must be made only under the guidance of Splunk Support or Services staff for use in a specific deployment of Splunk Enterprise. INFORMATION: The main value of this spec file is to assist in reading these files for troubleshooting purposes. default-mode.conf was originally intended to provide a way to describe the alternate setups used by the Splunk Light Forwarder and Splunk Universal Forwarder. The only reasonable action is to re-enable input pipelines that are disabled by default in those forwarder configurations. However, keep the prior caveats in mind. Any future means of enabling inputs will have a different form when this mechanism is removed. SYNTAX:
disabled = <boolean> disabled_processors = <string>
* Refers to a particular Splunkd pipeline. * The set of named pipelines is a splunk-internal design. That does not mean that the Splunk design is a secret, but it means it is not external for the purposes of configuration. * Useful information on the data processing system of splunk can be found in the external documentation, for example http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Datapipeline disabled = <boolean> * Whether or not the Splunk platform loads the specified pipeline. * If set to true on a specific pipeline, the pipeline will not be loaded in the system. disabled_processors = <processor1>, <processor2> * Processors which normally would be loaded in this pipeline are not loaded if they appear in this list. * The set of named processors is again a Splunk-internal design component.
This documentation applies to the following versions of Splunk® Enterprise: 8.1.1