Security

Splunk File presedence

ansif
Motivator

I know the configuration file precedence, my question is if /system/local is first path of a configuration file then Splunk skips to check /system/default for the same conf file?

Tags (1)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @ansif,

In splunk local directory has higher precedence than default directory which doesn't mean that splunk will not read conf file from default directory.

Let's take example of props.conf, you have $SPLUNK_HOME/etc/system/local/props.conf with below config

[yoursourcetype]
TRUNCATE = 20000

So in this case when splunk read configuration for sourcetype yoursourcetype it will take value for TRUNCATE parameter from $SPLUNK_HOME/etc/system/local/props.conf however remaining variable default setting will take from $SPLUNK_HOME/etc/system/default/props.conf for example MAX_EVENTS=256

To check in splunk which parameter is coming from which configuration file (local or default) you can use below command

$SPLUNK_HOME/bin/splunk cmd btool props --debug list

Here I have given example of props.conf but same applies to all .conf files.

I hope this helps.

Thanks,
Harshil

View solution in original post

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @ansif,

In splunk local directory has higher precedence than default directory which doesn't mean that splunk will not read conf file from default directory.

Let's take example of props.conf, you have $SPLUNK_HOME/etc/system/local/props.conf with below config

[yoursourcetype]
TRUNCATE = 20000

So in this case when splunk read configuration for sourcetype yoursourcetype it will take value for TRUNCATE parameter from $SPLUNK_HOME/etc/system/local/props.conf however remaining variable default setting will take from $SPLUNK_HOME/etc/system/default/props.conf for example MAX_EVENTS=256

To check in splunk which parameter is coming from which configuration file (local or default) you can use below command

$SPLUNK_HOME/bin/splunk cmd btool props --debug list

Here I have given example of props.conf but same applies to all .conf files.

I hope this helps.

Thanks,
Harshil

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

Can you please check Precedence order within global context: in this link?

http://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Wheretofindtheconfigurationfiles

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...