The answer is B
Index Time Precedence Order:
1 - System Local directory [etc/system/local]
2 - App Local directories [etc/apps/appname/local] (lexicographical order A..Z)
3 - App default directories [etc/apps/appname/default] (lexicographical order A..Z)
4 - System default directory [etc/system/default]
Confirmed per Splunk documentation https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Wheretofindtheconfigurationfiles
"When consuming a global configuration, such as inputs.conf, Splunk software first uses the attributes from any copy of the file in system/local. Then it looks for any copies of the file located in the app directories, adding any attributes found in them, but ignoring attributes already discovered in system/local."
Just did the Admin test today (passed), and got this question. In the actual question is not the same provided here - as mentioned below, the two local paths have different app names 'search' and 'unix', and not both as 'search'. In that case 'search' will take precedence over 'unix' - and so B is correct.
Yes, you are right.
There is a typo in the queston the last input .conf is as below.
SPLUNK_HOME/etc/app/unix/local/inputs.conf ( not search )
Option B
Should be 'A'.
Assuming the two 'apps' inputs are in the order provided, then the last stanza will override the first, meaning the index will be set to 'unixinfo'.
The host will be set by the system/local file, which takes precedence over app/local.
I took the test recently and the question here is wrong. With the question as stated here, the answer is A because it takes host from system/local and it takes the last valid stanza from apps/search/local. However in the actual question one of the stanzas comes from apps/unix/local instead of apps/search/local. In that case, it still takes host from system/local, but it takes index from apps/search/local because s comes before u.
Answer is B for index-time precedence order (see other comments) and, with replicated stanza in the same .conf file, the last one overrides the previous one.
Verify the configuration with btool and you get the last listed entry rule
I guess the questions is no correct...this way it just cannot be answered correctly because you cannot say which of the stanza1 entries is first in the /apps/search/local/inputs.conf...I would think that the second entry (with "host=unixsvr1" and index="unixinfo" should be located in /etc/apps/unix/local/inputs.conf..this would be inline with other examples used in the Administration courses (see System Administration Slide 82). Therefore answer B would be correct as the 'search' app comes before the 'unix' app in lexicographical order.
B is correct. Question has a typo.
I believe answer is A.
- etc/system/local/ has better precedence at index time
- for identical settings in the same file, the last one overwrite others, see :
https://community.splunk.com/t5/Getting-Data-In/What-is-the-precedence-for-identical-stanzas-within-a-single/m-p/283566
Answer is A. during index time, higher prevalence is for /etc/system/local/ with: host=server1 this combined with second prevalence wich is /etc/apps/search/local/ witch index=unixinfo.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
furiousjase
Highly Voted 2 years, 1 month agoucsdmiami2020
2 years, 1 month agoRodders2828
Highly Voted 10 months agotoney_mu
8 months agoBetoemihtevas
Most Recent 1 week, 1 day agotoney_mu
8 months agoRodders2828
10 months agoRodders2828
10 months agokgcykyzoxjxhvfazje
10 months agodenominator
1 year, 3 months agotoney_mu
8 months agoSeba0297
1 year, 4 months agoSeba0297
1 year, 4 months agoHelaros
1 year, 5 months agoaallpp
1 year, 10 months agosam_1215
1 year, 11 months agoSalman23
2 years agotom888
2 years, 1 month ago