Hi,
Because of the ridiculous nature in which Splunk handles serverclass.conf via the gui (really? I can create multiple serverclass.conf files, based upon where I was in the gui?)... I know have two serverclass.conf files and need to reconcile them. Is it as simple as appending one on to the other? Looking for suggestions...
-- Because of the ridiculous nature in which Splunk handles serverclass.conf via the gui (really? ..
The following Configuration file precedence
says -
-- As mentioned, Splunk decides how to evaluate a configuration file based on the context that the file operates within, global or app/user. Generally speaking, files that affect data input, indexing, or deployment activities are global; files that affect search activities usually have a app/user context.
serverclass.conf is defined there as a global configuration file similar to indexes.conf. It means that their "natural" location is at etc/system/local
which the admin class emphasizes.
If the GUI is app context sensitive and doesn't have a global context, I would say that this is a bug.
Looking at Use serverclass.conf to define server classes
It says -
It means that etc/system/local
is its location.