What are the values for host and index for [stanza1] used by Splunk during index time, given the following configuration files?

What are the values for host and index for [stanza1] used by Splunk during index time, given the following configuration files?

A . host=server1
index=unixinfo
B . host=server1
index=searchinfo
C . host=searchsvr1
index=searchinfo
D . host=unixsvr1
index=unixinfo

View Answer

Answer: A

Explanation:

– etc/system/local/ has better precedence at index time – for identical settings in the same file, the last one overwrite others, see : https://community.splunk.com/t5/Getting-Data-In/What-is-the-precedence-for-identical-stanzas-within-a-single/m-p/283566