Configuration order of precedence


This should be a softball for easy karma.

Can anybody tell me the order of precedence for configuration files?

As a specific example, for props.conf, I have

  1. /opt/splunk/etc/apps/my_silly_app/local/props.conf
  2. /opt/splunk/etc/users/my_silly_username/my_silly_app/local/props.conf
  3. /opt/splunk/etc/system/local/props.conf
  4. /opt/splunk/etc/system/default/props.conf name a few

When going back and forth between UI and bash edits, I sometimes am not sure which I should adjust/delete/ignore compared to others.

Tags (2)


I could use some Karma.

See the Order of precedence section.

You can run btool to see all the configuration values in use by your Splunk instance.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!