Now Splunk has restarted.
Let us log in.
I'll search for last one minute so that we'll get the just the latest events.
As you can see now we have a new entry host under app default.
It's better our understanding we are clear that when the same configuration is defined in all four location,
whatever is defined in system local will come up as a winner and Splunk while starting up picks up any
configuration here as its the final configuration.
If it couldn't find the configuration here it takes for these three directories.
If these three directories up local will be the winner and it will have the final configuration while
starting this plan.
Similarly, the app default and system default.
When it tests conflicting or the same configuration, the app default will have the highest priority
for any configuration between these two.
If Splunk was starting up, it couldn't find any configuration or customization that are defined in
these three.
It will look for our system default.
Let us go back and remove our default configuration from the app default directory.
I'll comment out these.
Restart my Splunk instance.
So now we should be back to normal.
We have not customised any configuration whatsoever.
It should be picking up directly from the system default location.
Splunk has started.
Let me run the search.
As we read in the search.
If you check for the latest event, it will be our default host name.
System default.
If you want to know where the system default to hostname it is picking up is it is the system default.
Inputs.
It is mentioned as desired on startup.
So if you have capital hostname command defined on your OS, it can pick up from the OS.
So what this decide on startup does is.
Well, starting up the Splunk, it will check for the host team of your machine where Splunk is installed,
and it will take that host name.
And it is it will assign it to your.
Logs that are generated out of those machines.
To be very clear.
When you are troubleshooting some configuration or you are editing some configuration in app default
or app locale, you see that it is not reflecting upon syntax being right and everything, but there
might be a configuration in system local which might be overwriting whatever you define under these
three location.
And also always keep in mind, never ever try to edit these default location folder.
Let me show you by default even though you are system.
Account is used to run Splunk.
Privilege or normal.
These files in system default will allow only read permission.
As you can see, this is the system default and all as read permission.
Splunk highly recommends not to edit these files so that if you mess up any configuration, your Splunk
might never start.
Make sure you never touch these files if you want to edit them.
Copy these files into any of these three locations and modify them.