Getting Data In

What is the precedence for identical stanzas within a single conf file? Is this a valid configuration?

mlorch
Path Finder

Hi,

I'm facing the situation that there is the identical stanza twice within a single conf file.
E.g.
authorize.conf

[role_admin]
srchIndexesDefault = main

[role_admin]
srchIndexesDefault = _internal

I know the documentation for Attribute precedence within a single props.conf file, but this only describes the precedence defined by ASCII order. Not if the stanza is identical.

Verifying the configuration with btool, I get that the last listed entry rules. Which makes sense.

So my question is: Is this a valid configuration (despite the fact that this should be avoided)?

Thanks and best regards,
Max.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If it wasn't valid, btool would have flagged it. As you say, this situation should be avoided.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If it wasn't valid, btool would have flagged it. As you say, this situation should be avoided.

---
If this reply helps you, Karma would be appreciated.

mlorch
Path Finder

Thanks. That's what I expected.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...