Module 4: Splunk Configuration Files

Question 1

What are the features of configuration files? (.conf)

Answer 1

• Govern aspects of Splunk functionality
• Text files using a generally case-sensitive [stanza] and attribute = value format
• Saved under $SPLUNK_HOME/etc

Question 2

What are the two ways to learn about conf files?

Answer 2

• Readme files - $SPLUNK_HOME/etc/system/README

* Spec files on Splunk docs

Question 3

What is a Splunk app?

Answer 3

• way of organising configuration files,
• directory under Splunk_home/etc/apps. E.g search and reporting is stored under Splunk_home/etc/apps/search
• an add-on is an app that usually does not contain GUI

Question 4

When editing conf files, it is best practice to only amend the ___ directory.

Answer 4

local

Question 5

What is meant by index time?

Answer 5

global context, such as input/parsing configuration

Question 6

What is meant by search time?

Answer 6

App/user scoped, such as a users knowledge object

Question 7

Name the index-time precedence.

Answer 7

1. Etc/system/local
2. Etc/apps/search/local
3. Etc/apps/app1/local
4. Etc/apps/search/default
5. Etc/apps/app1/default
6. Etc/system/default

Question 8

Name the search-time precedence.

Answer 8

1. Etc/users/john/app1/local
2. Etc/apps/app1/local
3. Etc/apps/app1/default
4. Etc/apps/search/local
5. Etc/apps/search/default
6. Etc/system/local
7. Etc/system/default

Question 9

If two or more apps have conflicting settings, the app directory name with the __ __ order wins.

Answer 9

highest ascii

Question 10

How does Splunk merge conf files?

Answer 10

• Upon startup, Splunk merges configuration files for each type
• The resulting file combines settings from various directory locations
• Only one file per file type will be used at run time
• If there is a conflict, precedence is applied.

Question 11

What is the btool command?

Answer 11

• btool is a Splunk command located in splunk_home/bin. It retrieves the on-disk configuration of a Splunk conf file.
• Syntax = Splunk btool list [options]
• –debug option shows the exact .conf file location