Splunk's configuration files live in $SPLUNK_HOME/etc. This is reminiscent of Unix's /etc directory but is instead contained within Splunk's directory structure.
This has the advantage that the files don't have to be owned by root. In fact, the entire Splunk installation can run as an unprivileged user (assuming you don't need to open a port below 1024 or read files only readable by another user).
The directories that contain configurations are as follows:
- $SPLUNK_HOME/etc/system/default: These are the default configuration files that ship with Splunk. Never edit these files as they will be overwritten each time you upgrade.
- $SPLUNK_HOME/etc/system/local: This is the location of the global configuration overrides specific to this host. There are very few configurations that need to live here—most configurations...
