apps

[hazem]

hello all,

if I have 2 apps deployed on  Splunk forwarder agent with outputs.conf file 

first one(all_UF_outputs) to send logs to indexers' ips and the other(all_splk_outputs )to send logs to indexers over the hostname.

how I can confirm which one has the highest precedence?

[hazem]

did you mean that the configuration in (all_UF_outputs) will override the (all_splk_outputs) because the Capital Letter (U) has the highest precedence than lower (s) ?

[gcusello · Accepted solution]

Hi @hazem ,

yes, there's a precedence in confoigurations at index time, but for custom apps it's related to the alphabetical precedence.

Anyway, it should run because you have a duplicated configuration that isn't required.

Ciao.

Giuseppe

[gcusello]

Hi @hazem ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[hazem]

did you mean that the configuration in (all_UF_outputs) will override the (all_splk_outputs) because the Capital Letter (U) has the highest precedence than lower (s) ?

[gcusello]

Hi @hazem ,

let me understand: you have two apps containing the same indexers addressing, or different ones?

if yes why?

Anyway, it isn't correct because the configuration in the first overrides the ones in the second.

Could you share your outputs.conf?

Ciao.

Giuseppe