What is the correct order of index time precedence? (For each of the following, highest precedence is shown at the top and lowest precedence is shown at the bottom)

The correct answer is B. .../etc/users/local. In Splunk, configuration file precedence flows from most specific (user-level local) to least specific (system-level default). The correct hierarchy from highest to lowest is: (1) .../etc/users/<user>/local - user-specific local overrides everything, (2) .../etc/apps/<app>/local

Configuration Files

Question

Options

A.../etc/users/local
B.../etc/users/local
C.../etc/system/local
D.../etc/system/default

How the community answered

(45 responses)

A
2% (1)
B
96% (43)
C
2% (1)

Explanation

In Splunk, configuration file precedence flows from most specific (user-level local) to least specific (system-level default). The correct hierarchy from highest to lowest is: (1) .../etc/users/<user>/local - user-specific local overrides everything, (2) .../etc/apps/<app>/local - app-level local, (3) .../etc/apps/<app>/default - app-level default, (4) .../etc/system/local - system-wide local, (5) .../etc/system/default - system-wide default, the baseline. Answer B reflects this correct top-down precedence. Splunk merges configs across all these locations, but when conflicts exist, higher-precedence files win.

Topics

#Configuration Precedence#Splunk File System#Local vs Default#User Configuration

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice