What is the order of precedence when there is conflicting configurations (such as timezone) at sourcetype, host and source level?
Hi anandhim,
you can find all the details on config file precedences here in the docs http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Wheretofindtheconfigurationfiles
Hope this helps ...
cheers, MuS
The order of precedence when processing stanzas in props.conf is:
As noted here: http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Propsconf
**[<spec>] stanza precedence:**
For settings that are specified in multiple categories of matching [<spec>] stanzas,
[host::<host>] settings override [<sourcetype>] settings. Additionally,
[source::<source>] settings override both [host::<host>] and
[<sourcetype>] settings.
Consider the following example:
The Universal Forwarder is installed on my_server01 and reading opt/myapp/system.log (source) and tagging it with a sourcetype of system_traffic.
We have 3 different props.conf files across 3 apps in our $splunk_home/etc/apps folder
$splunk_home/etc/apps/my_app1/default/props.conf:
[system_traffic]
TZ=UTC
$splunk_home/etc/apps/my_app2/default/props.conf:
[source::opt/myapp/system.log]
TZ=America/Los_Angeles
$splunk_home/etc/apps/my_app3/default/props.conf:
[host::my_server01]
TZ=America/New_York
Our resulting TZ for opt/myapp/system.log on my_server01 would be: TZ=America/Los_Angeles because the source stanza overrides both the host and the sourcetype stanzas.
nice answer!
Hi anandhim,
you can find all the details on config file precedences here in the docs http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Wheretofindtheconfigurationfiles
Hope this helps ...
cheers, MuS
Thanks .The information I needed was not on that page directly but a link to the page which contains the answer was present: http://docs.splunk.com/Documentation/Splunk/6.2.2/admin/Attributeprecedencewithinafile
Cheers