props definition is below, when i save it in app\search\local directory it doesn't work as expected{events are not broken properly}.
When saving the same configuration in system\local it works f...
Hi everyone,
I have Splunk_TA_aws and Splunk_TA_aws_knowledgeonly deployed to a distributed splunk environment from a deployment server. On the heavy forwarders UI we have configured inputs w...
I read the admin guide section on conf fileprecedence. It didn't see any info on the implications of a distributed setup.
Scenario:
search-head
indexer-1
indexer-2
I am thinking of having a p...
...rchIndexesDefault = _internal
I know the documentation for Attribute precedence within a single props.conf file, but this only describes the precedence defined by ASCII order. Not if the stanza is identical....
There is a lot of information regarding the order of the precedence of props.conf within a single Splunk server, but how about between servers? I assumed it would be the last server (i.e. the SH), b...
Hello all, I have what is probably a pretty basic question about configurationfiles. I know the precedence goes like this: 1. System local directory -- highest priority 2. A...
...ourcetype I added in the props.conf file which is deployed under /app/app_Name/local is taking precedence over another props.conf that I have out there with the same sourcetype which handles a lot of n...
For example, does Splunk ignore server.conf, distsearch.conf, or any other conf files if they're located in an apps directory?
Also, are there any other cases where a particular conf file's l...
I have integrated a deployment client into my environment to manager the configurationfiles but now I am having multiple issues with configurationfiles precedence. I am able to deploy new configuration...