SPLK-1003 · Question #32
Which layers are involved in Splunk configuration file layering? (select all that apply)
The correct answer is A. App context B. User context C. Global context. Splunk configuration file layering operates across three contexts: (A) App context - configurations scoped to a specific app (under $SPLUNK_HOME/etc/apps/<appname>/); (B) User context - user-specific configurations (under $SPLUNK_HOME/etc/users/<username>/); and (C) Global contex
Question
Which layers are involved in Splunk configuration file layering? (select all that apply)
Options
- AApp context
- BUser context
- CGlobal context
- DForwarder context
How the community answered
(22 responses)- A91% (20)
- D9% (2)
Explanation
Splunk configuration file layering operates across three contexts: (A) App context - configurations scoped to a specific app (under $SPLUNK_HOME/etc/apps/<appname>/); (B) User context - user-specific configurations (under $SPLUNK_HOME/etc/users/<username>/); and (C) Global context - system-wide configurations (under $SPLUNK_HOME/etc/system/). Splunk merges these layers at runtime with user context taking highest precedence, then app context, then global/system context. Option D (Forwarder context) is not a recognized configuration file layer in Splunk's merging hierarchy - forwarders are deployment roles, not a distinct configuration layer.
Topics
Community Discussion
No community discussion yet for this question.