Would someone confirm the following observations regarding data input configuration via inputs.conf?
If any of these are false, would you kindly explain?
Lots of good info in the "new" 4.1 manual. It seems much easier to configure. Thank you SPLUNK http://www.splunk.com/base/Documentation/4.1/Admin/Inputsconf
Per 3.
If by 'overlapping inputs' you mean say /var/log and /var/log, the settings are simply merged. One setting is going to win, the other setting discarded.
If, on the other hand, you mean /var and /var/log then something happens, and that something that happens is almost assuredly not what you want. Note that this case is addressed in 4.1, in that we intend it to be usable and reasonable