- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I read the admin guide section on conf file precedence. It didn't see any info on the implications of a distributed setup.
Scenario: search-head indexer-1 indexer-2
I am thinking of having a props file on the search head which references 2 different transforms. 1 of the transforms will be defined in the transforms file on the search head. The other transform will be located in etc/system/local on each of the indexers. Each indexer will have a slightly different version of the transform due to what they are processing.
Will splunk span the confs between the replicated search head props/transforms and the local indexer version of the transforms conf?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

For search-time configurations, only the configuration on the search head is considered. These configurations are automatically propagated to the indexers and used if necessary (e.g. field extractions used in search queries).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

For search-time configurations, only the configuration on the search head is considered. These configurations are automatically propagated to the indexers and used if necessary (e.g. field extractions used in search queries).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So if I have a limits.conf with multiple indexers, the file needs to be altered on the indexers, not the search heads?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


There is one exception; limits.conf settings are only used on the local system, so if you need to alter limits.conf settings they must be done on the indexing nodes.
