Determine whether the configuration file already exists in your preferred directory.Changes that you make in non-default configuration directories, such as $SPLUNK_HOME/etc/system/local or $SPLUNK_HOME/etc/apps//local, persist through upgrades. Any changes that you make in the default directory are lost on upgrade.
#Splunk conf files upgrade
The Splunk Enterprise upgrade process overwrites the default directory. The files in the default directory must remain intact and in their original location. Never change or copy the configuration files in the default directory.
Then, add the specific settings that you want to customize to the local configuration file. To customize a configuration file, create a new file with the same name in a local or app directory.
#Splunk conf files update
See Use the deployer to distribute apps and configuration updates in Distributed Search and Update common peer configurations and apps in Managing Indexers and Clusters of Indexers. If your deployment includes search head or indexer clusters, some changes you make to configuration files may need to be made to configuration files on every search head cluster member or indexer peer node.īefore you edit a configuration file, you need to understand whether to make the same change to the configuration file on every search head or indexer in the cluster. When you are editing a configuration file, you need to understand how Splunk software evaluates files in order of importance. The ways these copies are layered in the directories affect either the user, an app, or the system as a whole. A Splunk platform deployment can have multiple copies of the same configuration file in different directories. Splunk software uses configuration files to set defaults and limitations. Each stanza identifies settings that specify the configuration.īefore you edit a configuration file, you need to understand how the file's stanzas are structured. This layering effect that allows your Splunk platform deployment to determine configuration priorities.īefore you edit a configuration file, you need to know where to create the custom version of the configuration file.Ĭonfiguration files consist of stanzas. You can have configuration files with the same name in your default, local, and app directories. The following table describes what you need to know and where to find that information: You must understand how the configuration system works across your deployment and where to make the changes.You must be a user with file system access, such as a system administrator.You must meet the following prerequisites to edit configuration files: To customize a Splunk platform instance to meet your specific needs, you can edit the built-in configuration settings.
0 kommentar(er)
