Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
127 results
Sorted by:
05-14-2020
09:31 PM
...attern.
Then configuration file on indexer is of higher priority than those on universal forwarder. Is that correct?
Thanks a lot.
/st wong
11-16-2017
11:17 PM
props definition is below, when i save it in app\search\local directory it doesn't work as expected{events are not broken properly}.
When saving the same configuration in system\local it works f...
07-26-2019
09:10 AM
Hi everyone,
I have Splunk_TA_aws and Splunk_TA_aws_knowledgeonly deployed to a distributed splunk environment from a deployment server. On the heavy forwarders UI we have configured inputs w...
01-12-2011
11:25 PM
1 Karma
I read the admin guide section on conf file precedence. It didn't see any info on the implications of a distributed setup.
Scenario:
search-head
indexer-1
indexer-2
I am thinking of having a p...
12-17-2015
06:35 AM
...rchIndexesDefault = _internal
I know the documentation for Attribute precedence within a single props.conf file, but this only describes the precedence defined by ASCII order. Not if the stanza is identical....
10-28-2019
11:14 AM
There is a lot of information regarding the order of the precedence of props.conf within a single Splunk server, but how about between servers? I assumed it would be the last server (i.e. the SH), b...
09-10-2020
05:39 AM
Hello all, I have what is probably a pretty basic question about configuration files. I know the precedence goes like this: 1. System local directory -- highest priority 2. A...
Labels
- Labels:
-
indexer
02-17-2016
05:17 PM
...ourcetype I added in the props.conf file which is deployed under /app/app_Name/local is taking precedence over another props.conf that I have out there with the same sourcetype which handles a lot of n...
04-08-2010
10:12 PM
2 Karma
For example, does Splunk ignore server.conf, distsearch.conf, or any other conf files if they're located in an apps directory?
Also, are there any other cases where a particular conf file's l...
10-23-2017
01:37 PM
I have integrated a deployment client into my environment to manager the configuration files but now I am having multiple issues with configuration files precedence. I am able to deploy new configuration...
