The effect of app directory names varies depending on whether the context is global or local.Īpp directory names in the global context How app directory names affect precedenceįor most practical purposes, the information in this subsection probably won't matter, but it might prove useful if you need to force a certain order of evaluation or for troubleshooting. Splunk will always use the value of the user-level attribute, if any, in preference to a value for that same attribute set at the app or system level. System directories (local, followed by default) - lowest priorityĪn attribute in nf, for example, might be set at all three levels: the user, the app, and the system. App directories for all other apps (local, followed by default) - for exported settings onlyĤ. App directories for currently running app (local, followed by default)ģ. User directories for current user - highest priorityĢ. System default directory - lowest priorityįor files with an app/user context, directory priority descends from user to app to system:ġ. Peer-app local directories - highest priorityĦ. Here is the expanded precedence order for cluster peers:ġ. These directories exist only on indexer cluster peer nodes. Files in the peer-app directories have the highest precedence in a cluster peer's configuration. To keep configuration settings consistent across peer nodes, configuration files are managed from the cluster manager node, which pushes the files to the peer-app directories on the peer nodes. This is because some configuration files, like nf, must be identical across peer nodes. There is an expanded precedence order for indexer cluster peer configurations, which are considered in the global context. Precedence within global context, indexer cluster peers only Note: As the next section describes, cluster peer nodes have an expanded order of precedence. As a last resort, for any attributes not explicitly assigned at either the system or app level, it assigns default values from the file in the system/default directory. Then it looks for any copies of the file located in the app directories, adding any attributes found in them, but ignoring attributes already discovered in system/local. When consuming a global configuration, such as nf, Splunk software first uses the attributes from any copy of the file in system/local. System default directory - lowest priority System local directory - highest priorityĤ. When the file context is global, directory priority descends in this order:ġ. Splunk software considers the context of each file to determine the precedence order of the directories. To learn the context of each file, see List of configuration files and their context.Ĭonfiguration file precedence order depends on the location of file copies within the directory structure. The precedence order for configuration file directories varies according to the context of the particular configuration file. The app and user context is vital to search-time processing, where certain knowledge objects or actions might be valid only for specific users in specific apps. Some activities, like searching, take place in an app or user context. For example, configuration files that determine monitoring or indexing behavior occur outside of the app and user context and are global in nature. Activities like indexing take place in a global context. Configuration files operate in either a global context or in the context of the current app and user: To determine the order of directories for evaluating configuration file precedence, Splunk software considers each file's context. See Attribute precedence within a single nf file. Note: Besides resolving configuration settings among multiple copies of a file, Splunk software sometimes needs to resolve settings within a single file. It determines the priority of configuration files by their location in the directory structure, according to the rules described in this topic.When different copies have conflicting attribute values (that is, when they set the same attribute to different values), it uses the value from the file with the highest priority.It merges the settings from all copies of the file, using a location-based prioritization scheme.When incorporating changes, Splunk software does the following to your configuration files: When editing configuration files, it is important to understand how Splunk software evaluates these files and which ones take precedence. These file copies are usually layered in directories that affect either the users, an app, or the system as a whole. A Splunk platform deployment can have many copies of the same configuration file. Splunk software uses configuration files to determine nearly every aspect of its behavior.
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |