Dashboards & Visualizations

Adding a limits.conf under local

Dark_Ichigo
Builder

If I add a customized limits.conf under the system/local directory, will this override all of the file thats in the /system/default directory?, or will it just merge?

1 Solution

sideview
SplunkTrust
SplunkTrust

It acts like a normal conf file, Whatever keys you put in whatever stanzas in the local file -- those keys will be overridden in the Splunk instance. The other keys not specified in the local file will be drawn from the default/limits.conf. So it will merge .

View solution in original post

jgedeon120
Contributor

Dark_Ichigo,

Take a look at the configuration file precedence. It will come in handy when trying to trouble shoot why something works for one user but not another.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Wheretofindtheconfigurationfiles

Local folders are basically read before the defaults. Then what is set in the local files takes priority over the defaults. Think of it as a first in wins.

Example:

local/limits.conf

[thruput]
maxKBps = 512

defualt/limits.conf

[thruput]
maxKBps = 256

Your maxKBps is going to be 512, even though default says 256. It doesn't override it per-say, it ignores it because it is already set. Overriding something, something has to be set before it can be overridden. And with the order the config files are read/loaded, local conf files are before default conf files.

sideview
SplunkTrust
SplunkTrust

It acts like a normal conf file, Whatever keys you put in whatever stanzas in the local file -- those keys will be overridden in the Splunk instance. The other keys not specified in the local file will be drawn from the default/limits.conf. So it will merge .

Dark_Ichigo
Builder

Thanks!!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...