Dashboards & Visualizations

Adding a limits.conf under local

Dark_Ichigo
Builder

If I add a customized limits.conf under the system/local directory, will this override all of the file thats in the /system/default directory?, or will it just merge?

1 Solution

sideview
SplunkTrust
SplunkTrust

It acts like a normal conf file, Whatever keys you put in whatever stanzas in the local file -- those keys will be overridden in the Splunk instance. The other keys not specified in the local file will be drawn from the default/limits.conf. So it will merge .

View solution in original post

jgedeon120
Contributor

Dark_Ichigo,

Take a look at the configuration file precedence. It will come in handy when trying to trouble shoot why something works for one user but not another.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Wheretofindtheconfigurationfiles

Local folders are basically read before the defaults. Then what is set in the local files takes priority over the defaults. Think of it as a first in wins.

Example:

local/limits.conf

[thruput]
maxKBps = 512

defualt/limits.conf

[thruput]
maxKBps = 256

Your maxKBps is going to be 512, even though default says 256. It doesn't override it per-say, it ignores it because it is already set. Overriding something, something has to be set before it can be overridden. And with the order the config files are read/loaded, local conf files are before default conf files.

sideview
SplunkTrust
SplunkTrust

It acts like a normal conf file, Whatever keys you put in whatever stanzas in the local file -- those keys will be overridden in the Splunk instance. The other keys not specified in the local file will be drawn from the default/limits.conf. So it will merge .

Dark_Ichigo
Builder

Thanks!!!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...