Which layers are involved in Splunk configuration file layering? (Choose all that apply.)
Which layers are involved in Splunk configuration file layering? (Choose all that apply.)
In the context of Splunk configuration file layering, the primary contexts typically involved are the app context and the user context. Configuration files can be applied within the scope of a particular app and also specific to a user. The concept of a 'Global context' does not typically arise within standard Splunk documentation in this regard, while 'Forwarder context' is not considered part of configuration file layering. Hence, the correct layers involved are app context and user context.
ABC seems right to me
A B Cf C: About configuration file context To determine the order of directories for evaluating configuration file precedence, Splunk software considers each file's context. Configuration files operate in either a global context or in the context of the current app and user: Global. Activities like indexing take place in a global context. They are independent of any app or user. For example, configuration files that determine monitoring or indexing behavior occur outside of the app and user context and are global in nature. App/user. Some activities, like searching, take place in an app or user context. The app and user context is vital to search-time processing, where certain knowledge objects or actions might be valid only for specific users in specific apps.
The answer are A B C. reference link is below https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles
A, B & C are correct
A,b and C ===== •In case of conflicts, priority is based on the context: - Global context (index-time) -App/User context (search-time) ===
AB seems right to me
You forgot C.