Deployment Architecture

Two serverclass.conf files - now what?

a212830
Champion

Hi,

Because of the ridiculous nature in which Splunk handles serverclass.conf via the gui (really? I can create multiple serverclass.conf files, based upon where I was in the gui?)... I know have two serverclass.conf files and need to reconcile them. Is it as simple as appending one on to the other? Looking for suggestions...

1 Solution

ddrillic
Ultra Champion

-- Because of the ridiculous nature in which Splunk handles serverclass.conf via the gui (really? ..

The following Configuration file precedence

says -

-- As mentioned, Splunk decides how to evaluate a configuration file based on the context that the file operates within, global or app/user. Generally speaking, files that affect data input, indexing, or deployment activities are global; files that affect search activities usually have a app/user context.

serverclass.conf is defined there as a global configuration file similar to indexes.conf. It means that their "natural" location is at etc/system/local which the admin class emphasizes.

If the GUI is app context sensitive and doesn't have a global context, I would say that this is a bug.

Looking at Use serverclass.conf to define server classes

It says -

alt text

It means that etc/system/local is its location.

View solution in original post

Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...