The configuration merging logic
Configurations in different locations merge behind the scenes into one super configuration. Luckily, the merging happens in a predictable way, is fairly easy to learn, and there is a tool to help us preview this merging.
The merging order
The merging order is slightly different depending on whether the configuration is being used by the search engine or another part of Splunk. The difference is whether there is an active user and app.
The merging order outside of search
Configurations being used outside of search are merged in a fairly simple order. These configurations include the files to read, the indexed fields to create, the indexes that exist, deployment server and client configurations, and other settings. These ...
Get Implementing Splunk - Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
