https://community.splunk.com/t5/Getting-Data-In/sequence-order-of-conf-files-splunk-process/m-p/138965#M28571 <P>Configuration Fie precedence</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Wheretofindtheconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Wheretofindtheconfigurationfiles</A></P> <P>Data filter</P> <P><A href="http://answers.splunk.com/answers/1888/How-do-I-configure-Splunk-to-filter-out-events-I-don%E2%80%99t-want-to-index%3F">http://answers.splunk.com/answers/1888/How-do-I-configure-Splunk-to-filter-out-events-I-don%E2%80%99t-want-to-index%3F</A></P> Fri, 11 Jul 2014 14:10:48 GMT somesoni2 2014-07-11T14:10:48Z https://community.splunk.com/t5/Getting-Data-In/sequence-order-of-conf-files-splunk-process/m-p/138964#M28570 <P>Hi,<BR /> Would like to know what sequence/order Splunk processes the *.conf files, suppose if I have inputs.conf configured in different locations $SPLUNKHOME/etc/apps/search, $SPLUNKHOME/etc/system/local etc. Does one gets precedence over the other? </P> <P>Also I would like to monitor only WARN and ERROR messages in Splunk log files ($SPLUNKHOME/var/log/splunk)<BR /> Does the white list work for this purpose? Not sure if it looks only the file names? I used as below, but doesn't seem to work<BR /> whiltelist = (WARN|ERROR)</P> <P>Thanks for your help!</P> Fri, 11 Jul 2014 13:22:35 GMT https://community.splunk.com/t5/Getting-Data-In/sequence-order-of-conf-files-splunk-process/m-p/138964#M28570 bheemireddi 2014-07-11T13:22:35Z https://community.splunk.com/t5/Getting-Data-In/sequence-order-of-conf-files-splunk-process/m-p/138965#M28571 <P>Configuration Fie precedence</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Wheretofindtheconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Wheretofindtheconfigurationfiles</A></P> <P>Data filter</P> <P><A href="http://answers.splunk.com/answers/1888/How-do-I-configure-Splunk-to-filter-out-events-I-don%E2%80%99t-want-to-index%3F">http://answers.splunk.com/answers/1888/How-do-I-configure-Splunk-to-filter-out-events-I-don%E2%80%99t-want-to-index%3F</A></P> Fri, 11 Jul 2014 14:10:48 GMT https://community.splunk.com/t5/Getting-Data-In/sequence-order-of-conf-files-splunk-process/m-p/138965#M28571 somesoni2 2014-07-11T14:10:48Z