What is the order of precedence when there are conflicting configs (such as timezone) at the sourcetype, host and source level?

[anandhim]

What is the order of precedence when there is conflicting configurations (such as timezone) at sourcetype, host and source level?

[jchampagne_splu]

The order of precedence when processing stanzas in props.conf is:

1. source
2. host
3. sourcetype

As noted here: http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Propsconf

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>] stanzas,
[host::<host>] settings override [<sourcetype>] settings. Additionally,
[source::<source>] settings override both [host::<host>] and
[<sourcetype>] settings.

Consider the following example:
The Universal Forwarder is installed on my_server01 and reading opt/myapp/system.log (source) and tagging it with a sourcetype of system_traffic.

We have 3 different props.conf files across 3 apps in our $splunk_home/etc/apps folder

$splunk_home/etc/apps/my_app1/default/props.conf:

[system_traffic]
TZ=UTC

$splunk_home/etc/apps/my_app2/default/props.conf:

[source::opt/myapp/system.log]
TZ=America/Los_Angeles

$splunk_home/etc/apps/my_app3/default/props.conf:

[host::my_server01]
TZ=America/New_York

Our resulting TZ for opt/myapp/system.log on my_server01 would be: TZ=America/Los_Angeles because the source stanza overrides both the host and the sourcetype stanzas.

[MuS]

nice answer!

[MuS · Accepted solution]

Hi anandhim,

you can find all the details on config file precedences here in the docs http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Wheretofindtheconfigurationfiles

Hope this helps ...

cheers, MuS

[anandhim]

Thanks .The information I needed was not on that page directly but a link to the page which contains the answer was present: http://docs.splunk.com/Documentation/Splunk/6.2.2/admin/Attributeprecedencewithinafile

Cheers