File Precedence at boot time

[gcusello]

Hi at all,

I know the meaning of file precedence in file configurations at index and search time, but what's the precedence in structural files as outputs.conf or deploymentclient.conf?

My need is:

• I have to change the Deployment Server in an old installation,
• where, in Universal Forwarders, outputs.conf and deploymentclient.conf are in %SPLUNK_HOME/etc/system/local,
• and I'd like to insert them in a dedicated TA.

So must I manually delete the old files in %SPLUNK_HOME/etc/system/local, or the new files override the other configurations because they have precedence?

Reading the documentation I  think that the precedence is the one at Index time, so this means that files in %SPLUNK_HOME/etc/system/local have the precedence on the ones in TAs.

I'll start a lab to check this, but did anyone encountered this problem?

Ciao.

Giuseppe

[richgalloway · Accepted solution]

The precedence of config files is the same for all config files. $SPLUNK_HOME/etc/system/local overrides all other configs.
A common approach is to include in an app a scripted input that deletes $SPLUNK_HOME/etc/system/local/deploymnetclient.conf and outputs.conf so the local app can take effect.