Implementing Splunk 7 - Third Edition

Configuration merging – example 3

Let's do a little exercise, merging four configurations from different locations. In this case, we are not in search, so we will use the rules from the Merging order outside of search section.

Let's walk through a few sample configurations.

For $SPLUNK_HOME/etc/apps/d/default/props.conf, we have the following code:

[web_access] 
MAX_TIMESTAMP_LOOKAHEAD = 25 
TIME_PREFIX = ^[ 
[source::*.log] 
BREAK_ONLY_BEFORE_DATE = true 

For $SPLUNK_HOME/etc/system/local/props.conf, we have this code:

BREAK_ONLY_BEFORE_DATE = false 
[web_access] 
TZ = CST 

For $SPLUNK_HOME/etc/apps/d/local/props.conf, we have the following code:

[web_access] 
TZ = UTC 
[security_log] 
EXTRACT-<name> = [(?P<user>.*?)] 

For $SPLUNK_HOME/etc/apps/b/default/props.conf ...