Splunk Enterprise Certified Admin — Question 47

Using Splunk Web to modify config settings for a shared object, a revised config file with those changes is placed in which directory?

Answer options

• A. $SPLUNK_HOME/etc/apps/myApp/local
• B. $SPLUNK_HOME/etc/system/default/
• C. $SPLUNK_HOME/etc/system/local
• D. $SPLUNK_HOME/etc/apps/myApp/default

Correct answer: A

Explanation

The correct answer is A because the local directory is intended for user-defined configurations that override default settings. Options B and D refer to default directories that should not be modified directly, while C is typically used for system-wide configurations rather than app-specific changes.