Implementing Splunk 7, Third Edition - Third Edition

Configuration merging – example 4, search

In this case, we are in search, so we will use the more complicated merging order.

Assuming that we are currently working in the d app, let's merge the same configurations again. For simplicity, we are assuming that all attributes are shared globally. We will merge the same configurations listed previously in Configuration merging – example 3.

With d as our current app, we will now merge in this order:

$SPLUNK_HOME/etc/system/local/props.conf 
$SPLUNK_HOME/etc/apps/b/default/props.conf 
$SPLUNK_HOME/etc/apps/d/default/props.conf 
$SPLUNK_HOME/etc/apps/d/local/props.conf 

Walking through each merge, the configuration will look like this:

1. We will start with $SPLUNK_HOME/etc/system/local/props.conf: