Conf file precedence in a distributed setup?

[infrauser]

I read the admin guide section on conf file precedence. It didn't see any info on the implications of a distributed setup.

Scenario: search-head indexer-1 indexer-2

I am thinking of having a props file on the search head which references 2 different transforms. 1 of the transforms will be defined in the transforms file on the search head. The other transform will be located in etc/system/local on each of the indexers. Each indexer will have a slightly different version of the transform due to what they are processing.

Will splunk span the confs between the replicated search head props/transforms and the local indexer version of the transforms conf?

[gkanapathy · Accepted solution]

For search-time configurations, only the configuration on the search head is considered. These configurations are automatically propagated to the indexers and used if necessary (e.g. field extractions used in search queries).

[essklau]

So if I have a limits.conf with multiple indexers, the file needs to be altered on the indexers, not the search heads?

[jrodman]

There is one exception; limits.conf settings are only used on the local system, so if you need to alter limits.conf settings they must be done on the indexing nodes.