During search time, which directory of configuration files has the highest precedence?

During search time, which directory of configuration files has the highest precedence?
A . $SPLUNK_HOME/etc/system/local
B . $SPLUNK_HOME/etc/system/default
C . $SPLUNK_HOME/etc/apps/app1/local
D . $SPLUNK_HOME/etc/users/admin/local

Answer: C

Explanation:

Reference: https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Wheretofindtheconfigurationfiles

Subscribe
Notify of
guest
1 Comment
Inline Feedbacks
View all comments
Lewis Jackson
Lewis Jackson
3 years ago

C is correct. If you have the 8.1 Data Admin PDF, look on page 259. “admin” still has to have an “app” directory under it. Also, according to Splunk, “admin” does not count as the “user”