https://community.splunk.com/t5/Getting-Data-In/What-does-splunk-do-with-overlapping-index-definitions/m-p/105648#M22249 <P>It overlooks the existing definition if the index is defined in system folder. If the indexes.conf is defined in the app folders, it depends on the precedence of the app[<A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Wheretofindtheconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/latest/admin/Wheretofindtheconfigurationfiles</A> -&gt; How app directory names affect precedence ]. I have tested myself, splunk works fine. It only creates a new folders with same index names. But i am not sure about the old data if it's searchable or not.</P> <P>there is a good explanation of it, slightly related to the question</P> <P><A href="http://splunk-base.splunk.com/answers/50881/indexesconf-location">http://splunk-base.splunk.com/answers/50881/indexesconf-location</A></P> Wed, 24 Jul 2013 20:57:03 GMT linu1988 2013-07-24T20:57:03Z https://community.splunk.com/t5/Getting-Data-In/What-does-splunk-do-with-overlapping-index-definitions/m-p/105647#M22248 <P>Greetings. Suppose I create an indexes.conf file to be distributed to all of my indexers which contains a HOT and COLD volume definition. Then I distribute several apps to the indexer, which each contain their own indexes.conf file defining additional indexes, and referring to the HOT and COLD volumes.</P> <P>What happens if two of those applications contain the same indexes.conf index stanza? For instance, if indexes.conf A contains [MyIndex], and then indexes.conf B also contains [MyIndex]. Will splunk just take the first definition (not an issue here, they're both defined the same), or will it cause an error on the indexer??</P> Wed, 24 Jul 2013 16:43:29 GMT https://community.splunk.com/t5/Getting-Data-In/What-does-splunk-do-with-overlapping-index-definitions/m-p/105647#M22248 msarro 2013-07-24T16:43:29Z https://community.splunk.com/t5/Getting-Data-In/What-does-splunk-do-with-overlapping-index-definitions/m-p/105648#M22249 <P>It overlooks the existing definition if the index is defined in system folder. If the indexes.conf is defined in the app folders, it depends on the precedence of the app[<A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Wheretofindtheconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/latest/admin/Wheretofindtheconfigurationfiles</A> -&gt; How app directory names affect precedence ]. I have tested myself, splunk works fine. It only creates a new folders with same index names. But i am not sure about the old data if it's searchable or not.</P> <P>there is a good explanation of it, slightly related to the question</P> <P><A href="http://splunk-base.splunk.com/answers/50881/indexesconf-location">http://splunk-base.splunk.com/answers/50881/indexesconf-location</A></P> Wed, 24 Jul 2013 20:57:03 GMT https://community.splunk.com/t5/Getting-Data-In/What-does-splunk-do-with-overlapping-index-definitions/m-p/105648#M22249 linu1988 2013-07-24T20:57:03Z