Would like to know what sequence/order Splunk processes the *.conf files, suppose if I have inputs.conf configured in different locations $SPLUNKHOME/etc/apps/search, $SPLUNKHOME/etc/system/local etc. Does one gets precedence over the other?
Also I would like to monitor only WARN and ERROR messages in Splunk log files ($SPLUNKHOME/var/log/splunk)
Does the white list work for this purpose? Not sure if it looks only the file names? I used as below, but doesn't seem to work
whiltelist = (WARN|ERROR)