The easiest way probably is to check.
Is by searching for our internal logs.
Index is equal to internal.
Let us run for last 15 minutes.
Should be fine.
As you can see in last 15 minutes, there are two hostnames.
This was before we were testing hierarchical.
If we keep it.
Four.
Just like last five minute.
We'll be able to see our configuration from host system.
Local has been picked up as per our configuration.
This is right.
So this overrides any configuration that has been defined in this location.
We didn't change any default location because it is highly recommended to edit any configuration under
system default.
We have edited the three configuration out of these total.
The system local got the highest preference.
The configuration as you can see as reflected in our hostname.
Now what happens if.
I eliminate my first one.
But understanding it should be clear that the.
Hostname should be picked up from system local.
Let us remove our configuration from system local.
ATC system.
Local.
This is where we defined our configuration.
Let us remove this or you can command it out or you can completely remove it.
I'll go ahead and restart my Splunk instance.
What do we expect to have on a host field now?
It should be hosted under up local so that our second preference should be picked up from application
local directory.
RS Blanca successfully started.
Let me log in.
Let me read in the search for last 5 minutes.
As we can see now.
There is a new host entry that is hosted under app local sense in the last five minute.
This was the default system default before editing any configuration and this was after editing or specifying.
The same configuration under four different hierarchy the system local clearly one and we saw the first
one system local reflector when we see the second one when we remove the configuration from here, even
though the default is there, it will be overwritten by our app local.
It picked up our second hierarchy as a as per our understanding.
No, let us go ahead and remove our app local also.
So for that we'll be going under ATC apps.
This is the app name where we edited the configuration.
We will remove the local configuration now.
The final fight is between to pick up the configuration.
The final fight will be from app default and system default.
Let us restart our Splunk instant.
Once we have restarted our Splunk instance, we should be able to see our latest host entry that will
be hosted under app default.