#   Version 9.2.2.20240415
# DO NOT EDIT THIS FILE!
# Changes to default files will be lost on update and are difficult to
# manage and support.
#
# Please make any changes to system defaults by overriding them in
# apps or $SPLUNK_HOME/etc/system/local  
# (See "Configuration file precedence" in the web documentation).
#
# To override a specific setting, copy the name of the stanza and
# setting to the file where you wish to override it.

[distributedSearch]
disabled = false
serverTimeout = 10
servers =
useSHPBundleReplication = true
statusTimeout     = 10
connectionTimeout = 10
sendTimeout       = 30
receiveTimeout    = 600
bestEffortSearch  = false
authTokenConnectionTimeout = 5
authTokenSendTimeout = 10
authTokenReceiveTimeout = 10
defaultUriScheme = https 
bcsPath        = /bcs/v1/buckets
parallelReduceBackwardCompatibility = enterprise
searchableIndexMapping = enabled

[tokenExchKeys]
certDir = $SPLUNK_HOME/etc/auth/distServerKeys
publicKey = trusted.pem
privateKey = private.pem
genKeyScript = $SPLUNK_HOME/bin/splunk, createssl, audit-keys

[replicationSettings]
replicationPolicy = classic
connectionTimeout   = 60
sendRcvTimeout      = 60
replicationThreads  = auto
maxBundleSize       = 2048
warnMaxBundleSizePerc = 75
concerningReplicatedFileSize = 500
excludeReplicatedLookupSize = 0
allowDeltaUpload    = true
preCompressKnowledgeBundlesClassicMode  = true
preCompressKnowledgeBundlesCascadeMode  = false
sanitizeMetaFiles   = true
cascade_replication_status_interval = 60s
cascade_replication_status_unchanged_threshold = 5
cascade_plan_replication_retry_fast = true
cascade_plan_replication_threshold_failures = 0
statusQueueSize = 5
allowDeltaIndexing = true

[replicationSettings:refineConf]
# Replicate these specific *.conf files and their associated *.meta stanzas.
replicate.app               = true
replicate.authorize         = true
replicate.collections       = true
replicate.commands          = true
replicate.eventtypes        = true
replicate.fields            = true
replicate.field_filters     = true
replicate.segmenters        = true
replicate.literals          = true
replicate.lookups           = true
replicate.macros            = true
replicate.multikv           = true
replicate.props             = true
replicate.tags              = true
replicate.transforms        = true
replicate.transactiontypes  = true

[replicationAllowlist]
refine.conf = (system|(apps/*)|users(/_reserved)?/*/*)/(default|local)/*.conf
refine.metadata = (system|(apps/*)|users(/_reserved)?/*/*)/metadata/*.meta
other = (system|(apps/(?!pdfserver)*)|users(/_reserved)?/*/*)/(bin|lookups)/...
kvstore = kvstore_*/...

[replicationDenylist]
lookupindexfiles = (system|apps/*|users(/_reserved)?/*/*)/lookups/*.(tmp$|index((|.alive|.lock)$|/...))
sampleapp = apps/sample_app/...
# Protect against overly-broad conf allowlists.
conf = (system|(apps/*))/(default|local)/server.conf
# Search processes do not use anything contained in user-specific *.meta files.
user_specific_meta = users(/_reserved)?/*/*/metadata/local.meta
framework = apps/framework/...
precompiled_python = ....pyc$


[bundleEnforcerAllowlist]


[bundleEnforcerDenylist]