Splunk 7.x Quick Start Guide

Configuration file precedence

Splunk uses configuration (.conf) files to control nearly every aspect of its operation. There are numerous configuration files with the same name layered inside of different directories that affect users, an app, or the system as a whole, so upon startup, Splunk merges the contents of these files based upon a directory location-based prioritization scheme to achieve an overall working configuration in memory. The rules Splunk follows when merging these files are as follows:

• When different copies of the same file have conflicting attribute values (when they set the same attribute to different values), it uses the value from the file with the highest precedence.
• The precedence of configuration files is determined ...