File Precedence at boot time

gcusello — Fri, 24 Jul 2020 10:46:18 GMT

Hi at all,

I know the meaning of file precedence in file configurations at index and search time, but what's the precedence in structural files as outputs.conf or deploymentclient.conf?

My need is:

I have to change the Deployment Server in an old installation,
where, in Universal Forwarders, outputs.conf and deploymentclient.conf are in %SPLUNK_HOME/etc/system/local,
and I'd like to insert them in a dedicated TA.

So must I manually delete the old files in %SPLUNK_HOME/etc/system/local, or the new files override the other configurations because they have precedence?

Reading the documentation I think that the precedence is the one at Index time, so this means that files in %SPLUNK_HOME/etc/system/local have the precedence on the ones in TAs.

I'll start a lab to check this, but did anyone encountered this problem?

Ciao.

Giuseppe

Re: File Precedence at boot time

richgalloway — Fri, 24 Jul 2020 12:35:19 GMT

The precedence of config files is the same for all config files. $SPLUNK_HOME/etc/system/local overrides all other configs.
A common approach is to include in an app a scripted input that deletes $SPLUNK_HOME/etc/system/local/deploymnetclient.conf and outputs.conf so the local app can take effect.

topic Re: File Precedence at boot time in Installation

File Precedence at boot time

Re: File Precedence at boot time