Getting Data In

What is the order of precedence when there are conflicting configs (such as timezone) at the sourcetype, host and source level?

anandhim
Path Finder

What is the order of precedence when there is conflicting configurations (such as timezone) at sourcetype, host and source level?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi anandhim,

you can find all the details on config file precedences here in the docs http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Wheretofindtheconfigurationfiles

Hope this helps ...

cheers, MuS

View solution in original post

jchampagne_splu
Splunk Employee
Splunk Employee

The order of precedence when processing stanzas in props.conf is:

  1. source
  2. host
  3. sourcetype

As noted here: http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Propsconf

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>] stanzas,
[host::<host>] settings override [<sourcetype>] settings. Additionally,
[source::<source>] settings override both [host::<host>] and
[<sourcetype>] settings.

Consider the following example:
The Universal Forwarder is installed on my_server01 and reading opt/myapp/system.log (source) and tagging it with a sourcetype of system_traffic.

We have 3 different props.conf files across 3 apps in our $splunk_home/etc/apps folder

$splunk_home/etc/apps/my_app1/default/props.conf:

[system_traffic]
TZ=UTC

$splunk_home/etc/apps/my_app2/default/props.conf:

[source::opt/myapp/system.log]
TZ=America/Los_Angeles

$splunk_home/etc/apps/my_app3/default/props.conf:

[host::my_server01]
TZ=America/New_York

Our resulting TZ for opt/myapp/system.log on my_server01 would be: TZ=America/Los_Angeles because the source stanza overrides both the host and the sourcetype stanzas.

MuS
SplunkTrust
SplunkTrust

nice answer!

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi anandhim,

you can find all the details on config file precedences here in the docs http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Wheretofindtheconfigurationfiles

Hope this helps ...

cheers, MuS

anandhim
Path Finder

Thanks .The information I needed was not on that page directly but a link to the page which contains the answer was present: http://docs.splunk.com/Documentation/Splunk/6.2.2/admin/Attributeprecedencewithinafile

Cheers

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...