What is the correct order of index time precedence? (For each of the following, highest precedence is shown at the top and lowest precedence is shown at the bottom)
A.
.../etc/users/local .../etc/system/default .../etc/apps/aaa/local .../etc/apps/zzz/default .../etc/system/local
B.
.../etc/users/local .../etc/system/local .../etc/apps/aaa/local .../etc/apps/zzz/default .../etc/system/default
C.
.../etc/system/local .../etc/apps/aaa/local .../etc/apps/zzz/default .../etc/system/default
D.
.../etc/system/default .../etc/apps/aaa/local .../etc/apps/zzz/default .../etc/system/local
The correct answer is C.
Index-time (global context) precedence:
Precedence within global context
When the file context is global, directory priority descends in this order:
1. System local directory -- highest priority
2. App local directories
3. App default directories
4. System default directory -- lowest priority
The users directory will never be taken into account in the global context.
Source:
https://docs.splunk.com/Documentation/Splunk/9.4.1/Admin/Wheretofindtheconfigurationfiles
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Betoemihtevas
1 week, 3 days ago