I've inherited an older Splunk instance (6.2.2) that appears to have multiple **/local/outputs.conf** files. While I'm familiar with the precedence inside of the *outputs.conf* file that I'm used to working with inside of **/system/local/** (Global, Target, Single,) I don't know who wins the fight when there are multiple /local/outputs.conf files. Can anyone shed some light on the order of precedence for the following:
[splunk@superawesomeserver etc]$ locate outputs.conf
/data/splunkforwarder/etc/system/local/outputs.conf
/opt/splunkforwarder/etc/apps/uni_splunk_forwarders/local/outputs.conf
/opt/splunkforwarder/etc/system/local/outputs.conf
Obviously, there appears to be two $SPLUNK_HOME's, which is another issue altogether, but when it comes down to the apps vs system outputs.conf, how do they merge?
Thanks in advance!
↧