Working with Apps - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 189

• default and local : These two directories contain the vast majority of the
configurations that make up an app. We will discuss these configurations
and how they merge in Chapter 10 , Configuring Splunk . Here is a brief look:
° Newly created, unshared objects live in $SPLUNK_HOME/etc/users/
USERNAME/APPNAME/local .
° Once an object is shared at the App or Global level, the object is
moved to $SPLUNK_HOME/etc/APPNAME/local .
° Files in local take precedence over its equivalent value in default.
° Dashboards live in (default|local)/data/ui/views .
° Navigations lives in (default|local)/data/ui/nav .
° When editing files by hand, my general rule of thumb is to place
configurations in local unless the app will be redistributed. We'll
discuss this in more detail in the Adding your app to Splunkbase section.
• lookups : Lookup files belong in this directory. They are then referenced in
(default|local)/transforms.conf .
• metadata : The files default.meta and local.meta in this directory tell
Splunk how configurations in this app should be shared. It is generally
much easier to edit these settings through the Manager interface.
Let's look at the contents of our is_app_one app, which we created earlier:
appserver/static/appIcon.png
appserver/static/application.css
appserver/static/appLogo.png
appserver/static/graph.png
appserver/static/intro.html
bin/README
default/app.conf
default/data/ui/nav/default.xml
default/data/ui/views/README
local/app.conf
local/data/ui/nav/default.xml
local/data/ui/views/errors.xml
local/data/ui/views/included.xml
local/savedsearches.conf
local/viewstates.conf
metadata/default.meta
metadata/local.meta