Splunk Interview Questions for Admin

2. Significance of default/local folder in apps?

In a Splunk app the various pieces comprising the app are represented as files in the file system that are installed on the Splunk server. All of the packaged components for a given app must be located in a directory under $SPLUNK_HOME/etc/apps.

The default and local directories mirror the subdirectory structure of each other. App-specific customizations in local override corresponding items in the default directory. Packaged Splunk apps should not contain a local directory. Otherwise, a local directory could overwrite configurations that a customer made to their copy of the app. Also, during an app upgrade the default configuration will be overridden while the local directory is preserved.