Getting Data In

What is the precedence for identical stanzas within a single conf file? Is this a valid configuration?

mlorch
Path Finder

Hi,

I'm facing the situation that there is the identical stanza twice within a single conf file.
E.g.
authorize.conf

[role_admin]
srchIndexesDefault = main

[role_admin]
srchIndexesDefault = _internal

I know the documentation for Attribute precedence within a single props.conf file, but this only describes the precedence defined by ASCII order. Not if the stanza is identical.

Verifying the configuration with btool, I get that the last listed entry rules. Which makes sense.

So my question is: Is this a valid configuration (despite the fact that this should be avoided)?

Thanks and best regards,
Max.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If it wasn't valid, btool would have flagged it. As you say, this situation should be avoided.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If it wasn't valid, btool would have flagged it. As you say, this situation should be avoided.

---
If this reply helps you, Karma would be appreciated.

mlorch
Path Finder

Thanks. That's what I expected.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...