Implementing Splunk 7, Third Edition - Third Edition

Configuration merging – example 1

Say we have the base configuration, default/sample1.conf:

[foo] 
bar=10 
la=20 

And, say we merge a second configuration, local/sample1.conf:

[foo] 
bar=15 

The resultant configuration would be as follows:

[foo] 
bar=15 
la=20 

The things to note here are as follows:

• The second configuration does not simply replace the prior configuration
• The value of bar is taken from the second configuration
• The lack of a la property in the second configuration does not remove the value from the final configuration