The configuration file hierarchy is plant at the beginning can be a difficult to understand, but I'll
try to make it as much simple as I can and also let us test the configuration and validate how the hierarchy
works.
In our demo instance of Amazon, the hierarchy of Splunk configuration files are arranged as below.
As per their hierarchy in Splunk to override configuration.
The system local is the.
Holding the highest privilege for.
Over 18 configuration.
Let's say you define some configuration in system local and it's a system local.
It will be under ATC system local, whatever the configuration you define in this directory will be
overwritten across the configuration which are defined in these three locations.
This will be your highest hierarchy for the Splunk configuration.
The second is the app local.
The app lokal will be under Etsy.
It is.
Apps.
One of the apps.
Let's begin with the default app search and.
So there is no local file as of now.
But we can create our own local files you'll be able to see in our Demo Splunk instance, which has
already been started.
So let's see if there is any.
Let me change the font size.
This should be clear enough.
Yes.
But now we know will be using application account called Splunk through order to do real.
For running a Splunk instance.
Let me check whether we have a Splunk instance running.
It is not running.
Let me bring it up.
To start Splunk.
This will be your command, the complete path.
Or you can go to this directory and use the Splunk utility with an argument start.
Now this plan is up.
Let us see.
Will go to the Caesars Blanco Etsy apps search.
Local.
See there is files which have been created, that is data, models and data which has been edited by
the user or admin.
So this is our apps local location center, etsy apps and the app name followed by local.
This is the second highest.
Configuration which Splunk can override.
The next is the app default.
Since we are seeing the search, local will see the same default location.
I'll go one directory behind.
Let me check the default directory.
So here is our default directory.
So this is the default directory of application.
It has a couple of configuration files which are which it can override upon system default.
The system default is our least hierarchical system.
Local is the highest.
Whatever you define here will be overwritten no matter what it is present in these three location system
default location contains.
Let me quickly go into system local.
That is Splunk followed by ETSI System Local which contains all the configuration.
Sorry.
Should be system default.
Which contains all the configurations of Splunk so that even if a user misses some of the configuration,
it can start from the default configuration.
Business plan process starts up.
Let's see how it will pick up the port FTP or FTP as port first.
It will check for system local.
If it is there, it will ignore all three of this even though if they are mentioned to customize port,
but anything that is mentioned here will be overwritten.
Similarly, the next step for checking.
If it couldn't find the configuration for the HTTP or HTTPS ports here, it will move to app local.
If it couldn't find here, then it will move on to app default.
If.
The user has not defined any of the customization for the HTTP or http port.
Then it will automatically pick up from our Splunk default location, which all the configuration required
for starting a Splunk instance are defined by default.
So this is as part of your installation package, you will get all this default configuration so that
the Splunk, as soon as you install the package, it will get all the configuration from your system
default location.
So this configuration can be overwritten from any of these locations.