You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
97 lines
3.1 KiB
97 lines
3.1 KiB
# Version 9.2.2.20240415
|
|
# DO NOT EDIT THIS FILE!
|
|
# Changes to default files will be lost on update and are difficult to
|
|
# manage and support.
|
|
#
|
|
# Please make any changes to system defaults by overriding them in
|
|
# apps or $SPLUNK_HOME/etc/system/local
|
|
# (See "Configuration file precedence" in the web documentation).
|
|
#
|
|
# To override a specific setting, copy the name of the stanza and
|
|
# setting to the file where you wish to override it.
|
|
|
|
[distributedSearch]
|
|
disabled = false
|
|
serverTimeout = 10
|
|
servers =
|
|
useSHPBundleReplication = true
|
|
statusTimeout = 10
|
|
connectionTimeout = 10
|
|
sendTimeout = 30
|
|
receiveTimeout = 600
|
|
bestEffortSearch = false
|
|
authTokenConnectionTimeout = 5
|
|
authTokenSendTimeout = 10
|
|
authTokenReceiveTimeout = 10
|
|
defaultUriScheme = https
|
|
bcsPath = /bcs/v1/buckets
|
|
parallelReduceBackwardCompatibility = enterprise
|
|
searchableIndexMapping = enabled
|
|
|
|
[tokenExchKeys]
|
|
certDir = $SPLUNK_HOME/etc/auth/distServerKeys
|
|
publicKey = trusted.pem
|
|
privateKey = private.pem
|
|
genKeyScript = $SPLUNK_HOME/bin/splunk, createssl, audit-keys
|
|
|
|
[replicationSettings]
|
|
replicationPolicy = classic
|
|
connectionTimeout = 60
|
|
sendRcvTimeout = 60
|
|
replicationThreads = auto
|
|
maxBundleSize = 2048
|
|
warnMaxBundleSizePerc = 75
|
|
concerningReplicatedFileSize = 500
|
|
excludeReplicatedLookupSize = 0
|
|
allowDeltaUpload = true
|
|
preCompressKnowledgeBundlesClassicMode = true
|
|
preCompressKnowledgeBundlesCascadeMode = false
|
|
sanitizeMetaFiles = true
|
|
cascade_replication_status_interval = 60s
|
|
cascade_replication_status_unchanged_threshold = 5
|
|
cascade_plan_replication_retry_fast = true
|
|
cascade_plan_replication_threshold_failures = 0
|
|
statusQueueSize = 5
|
|
allowDeltaIndexing = true
|
|
|
|
[replicationSettings:refineConf]
|
|
# Replicate these specific *.conf files and their associated *.meta stanzas.
|
|
replicate.app = true
|
|
replicate.authorize = true
|
|
replicate.collections = true
|
|
replicate.commands = true
|
|
replicate.eventtypes = true
|
|
replicate.fields = true
|
|
replicate.field_filters = true
|
|
replicate.segmenters = true
|
|
replicate.literals = true
|
|
replicate.lookups = true
|
|
replicate.macros = true
|
|
replicate.multikv = true
|
|
replicate.props = true
|
|
replicate.tags = true
|
|
replicate.transforms = true
|
|
replicate.transactiontypes = true
|
|
|
|
[replicationAllowlist]
|
|
refine.conf = (system|(apps/*)|users(/_reserved)?/*/*)/(default|local)/*.conf
|
|
refine.metadata = (system|(apps/*)|users(/_reserved)?/*/*)/metadata/*.meta
|
|
other = (system|(apps/(?!pdfserver)*)|users(/_reserved)?/*/*)/(bin|lookups)/...
|
|
kvstore = kvstore_*/...
|
|
|
|
[replicationDenylist]
|
|
lookupindexfiles = (system|apps/*|users(/_reserved)?/*/*)/lookups/*.(tmp$|index((|.alive|.lock)$|/...))
|
|
sampleapp = apps/sample_app/...
|
|
# Protect against overly-broad conf allowlists.
|
|
conf = (system|(apps/*))/(default|local)/server.conf
|
|
# Search processes do not use anything contained in user-specific *.meta files.
|
|
user_specific_meta = users(/_reserved)?/*/*/metadata/local.meta
|
|
framework = apps/framework/...
|
|
precompiled_python = ....pyc$
|
|
|
|
|
|
[bundleEnforcerAllowlist]
|
|
|
|
|
|
[bundleEnforcerDenylist]
|