Installation

File Precedence at boot time

gcusello
SplunkTrust
SplunkTrust

Hi at all,

I know the meaning of file precedence in file configurations at index and search time, but what's the precedence in structural files as outputs.conf or deploymentclient.conf?

My need is:

  • I have to change the Deployment Server in an old installation,
  • where, in Universal Forwarders, outputs.conf and deploymentclient.conf are in %SPLUNK_HOME/etc/system/local,
  • and I'd like to insert them in a dedicated TA.

So must I manually delete the old files in %SPLUNK_HOME/etc/system/local, or the new files override the other configurations because they have precedence?

Reading the documentation I  think that the precedence is the one at Index time, so this means that files in %SPLUNK_HOME/etc/system/local have the precedence on the ones in TAs.

I'll start a lab to check this, but did anyone encountered this problem?

Ciao.

Giuseppe

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
The precedence of config files is the same for all config files. $SPLUNK_HOME/etc/system/local overrides all other configs.
A common approach is to include in an app a scripted input that deletes $SPLUNK_HOME/etc/system/local/deploymnetclient.conf and outputs.conf so the local app can take effect.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
The precedence of config files is the same for all config files. $SPLUNK_HOME/etc/system/local overrides all other configs.
A common approach is to include in an app a scripted input that deletes $SPLUNK_HOME/etc/system/local/deploymnetclient.conf and outputs.conf so the local app can take effect.
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...