Deployed bundles not taking effect?

Changes made in /etc/system/local override any configuration bundles that you may be trying to publish to your Splunk instances using a DeploymentServer.

Serveral customers have reported that DeploymentServer configuration bundles were not taking effect, only to realize after several troubleshooting cycles that there was some configuration in /etc/system/local that was preventing that from happening. Note that any configuration in /etc/system/local will always take precedence over any other configuration in the system – even deployed bundles.

So, if you are stuck in this position, please make sure to check your /etc/system/local before hitting the panic button!

Inder Sabharwal

Posted by