Deployment Architecture

Two serverclass.conf files - now what?

a212830
Champion

Hi,

Because of the ridiculous nature in which Splunk handles serverclass.conf via the gui (really? I can create multiple serverclass.conf files, based upon where I was in the gui?)... I know have two serverclass.conf files and need to reconcile them. Is it as simple as appending one on to the other? Looking for suggestions...

1 Solution

ddrillic
Ultra Champion

-- Because of the ridiculous nature in which Splunk handles serverclass.conf via the gui (really? ..

The following Configuration file precedence

says -

-- As mentioned, Splunk decides how to evaluate a configuration file based on the context that the file operates within, global or app/user. Generally speaking, files that affect data input, indexing, or deployment activities are global; files that affect search activities usually have a app/user context.

serverclass.conf is defined there as a global configuration file similar to indexes.conf. It means that their "natural" location is at etc/system/local which the admin class emphasizes.

If the GUI is app context sensitive and doesn't have a global context, I would say that this is a bug.

Looking at Use serverclass.conf to define server classes

It says -

alt text

It means that etc/system/local is its location.

View solution in original post

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...