Configuration merging – example 4, search

In this case, we are in search, so we will use the more complicated merging order.

Assuming that we are currently working in the d app, let's merge the same configurations again. For simplicity, we are assuming that all attributes are shared globally. We will merge the same configurations listed previously in Configuration merging – example 3.

With d as our current app, we will now merge in this order:

$SPLUNK_HOME/etc/system/local/props.conf 
$SPLUNK_HOME/etc/apps/b/default/props.conf 
$SPLUNK_HOME/etc/apps/d/default/props.conf 
$SPLUNK_HOME/etc/apps/d/local/props.conf

Walking through each merge, the configuration will look like this:

  1. We will start with $SPLUNK_HOME/etc/system/local/props.conf:

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial