topic Default Configuration in Deployment Architecture

Default Configuration

michaeler — Thu, 10 Sep 2020 12:39:21 GMT

Hello all,

I have what is probably a pretty basic question about configuration files. I know the precedence goes like this:

1. System local directory -- highest priority
2. App local directories
3. App default directories
4. System default directory -- lowest priority

But if I have only a few things addressed in my inputs.conf in my system\local directory like :

[WinEventLogs://Security]
[WinEventLogs://Application]
[WinEventLogs://System]

Do the additional stanzas in my system\default directory inputs.conf file get applied as well and only the ones I specifically addressed above override whats in the default conf? Or is this file ignored because I have an inputs.conf in my local directory?

Re: Default Configuration

thambisetty — Thu, 10 Sep 2020 13:31:43 GMT

Do the additional stanzas in my system\default directory inputs.conf file get applied as well

yes

and only the ones I specifically addressed above override whats in the default conf?

yes

Or is this file ignored because I have an inputs.conf in my local directory?

new attributes for the same stanza will not be ignored from default. if there is same attribute defined in both local and default for a particular stanza then the one which is defined in local will take precedence

let me give you an example:

system/local/inputs.conf

[WinEventLogs://Security] index=windows sourcetype=sourcetype_local

system/default/inputs.conf

[WinEventLogs://Security] index=windows sourcetype=sourcetype_default source=source_default [WinEventLogs://Application] index=windows sourcetype=st_app_default

Final config of Splunk will be like

[WinEventLogs://Security] # This is available in local index=windows # This is available in local sourcetype=sourcetype_local # This is available in local source=source_default # This is from default [WinEventLogs://Application] index=windows sourcetype=st_app_default

Splunk doc example for file precedence is below:

https://docs.splunk.com/Documentation/Splunk/8.0.6/Admin/Wheretofindtheconfigurationfiles#Example_of_how_attribute_precedence_works

Re: Default Configuration

gcusello — Thu, 10 Sep 2020 13:32:55 GMT

Hi @michaeler,

if you have a configuration in two stanzas, the one with highest priority wins.

If you have a configuration in only one stanza, it's applied to your data, so if you have a configuration only in system\default, it's applied to your data.

Infact, if you want to exclude a configuration that's present in system\default, you have to find a value to override it in system local\ or delete from system\default, otherwise it's applied.

Ciao.

Giuseppe