Locating Splunk configuration files

Splunk's configuration files live in $SPLUNK_HOME/etc. This is reminiscent of Unix's /etc directory but is instead contained within Splunk's directory structure. This has the advantage that the files don't have to be owned by root. In fact, the entire Splunk installation can run as an unprivileged user (assuming you don't need to open a port below 1024 or read files only readable by another user).

The directories that contain configurations are:

• $SPLUNK_HOME/etc/system/default: The default configuration files that ship with Splunk. Never edit these files as they will be overwritten each time you upgrade.

• $SPLUNK_HOME/etc/system/local: This is the location of global configuration overrides specific to this host. There are very few configurations that need to live here—most configurations that do live here are created by Splunk itself. In almost all cases, you should make your configuration files inside of an app.

• $SPLUNK_HOME/etc/apps/$app_name/default...