Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?
Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?
The Splunk configuration parameter settings with the highest precedence are found in the system local directory. This directory takes precedence over app directories and the system default directory. The system local directory is checked first before any other directory when determining the final configuration settings.
Answer is A
A - In the absence of any information about context, assume it's global and the system local directory takes precedence: https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/Wheretofindtheconfigurationfiles#How_Splunk_determines_precedence_order
Precedence within global context When the file context is global, directory priority descends in this order: 1. System local directory -- highest priority 2. App local directories 3. App default directories 4. System default directory -- lowest priority
Altough /etc/system/local got highest precedence of all, /etc/system/local is not considered to be an app. So the answer is C, as .conf files are merged in a way, where those that comes from app with name higher in ASCII order takes precedence.
Answer is C: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles#How_Splunk_determines_precedence_order Precedence within app or user context For files with an app/user context, directory priority descends from user to app to system: 1. User directories for current user -- highest priority 2. App directories for currently running app (local, followed by default) 3. App directories for all other apps (local, followed by default) -- for exported settings only 4. System directories (local, followed by default) -- lowest priority