By Splunk July 28, 2008
Changes made in /etc/system/local override any configuration bundles that you may be trying to publish to your Splunk instances using a DeploymentServer.
Serveral customers have reported that DeploymentServer configuration bundles were not taking effect, only to realize after several troubleshooting cycles that there was some configuration in /etc/system/local that was preventing that from happening. Note that any configuration in /etc/system/local will always take precedence over any other configuration in the system – even deployed bundles.
So, if you are stuck in this position, please make sure to check your /etc/system/local before hitting the panic button!
----------------------------------------------------
Thanks!
Inder Sabharwal