Bundle precedence

Bundle precedence

Within a configuration file, attributes are set for sources, source types, and hosts. Configuration files exist in multiple places: default, local and any bundles you create. It is possible that an attribute for any specification will be found in more than one file. The evaluation order of configuration files are:

• local
• <bundle-name> (a user-created bundle)
  • bundles are evaluated in alphabetical order
• default

So local has precedence over all. When determining which attributes apply to a host, source or source type, keep in mind that precedence is applied attribute-by-attribute. That is, if the file props.conf exists in local and a user created bundle directory, the props.conf file in local does not override or replace the entire props.conf file in the bundle. If the same attribute/specification exists in both the local props.conf and the user created bundle props.conf, the local props.conf overrides the attribute.

For example, if $SPLUNK_HOME/etc/bundles/local/props.conf contains this stanza:

[source::/opt/Locke/Logs/error*]
sourcetype = t2rss-error

And $SPLUNK_HOME/etc/bundles/t2rss_bundle/props.conf contains this stanza:

[source::/opt/Locke/Logs/error*]
SHOULD_LINEMERGE = True
BREAK_ONLY_BEFORE_DATE = True

Both the sourcetype assignment in local and the line merging attributes in t2rss_bundle will apply. However, if both local and t2rss_bundle had a sourcetype assignment for source::/opt/Locke/Logs/error*, the assignment in local overrides t2rss_bundle.

Precedence rules for events with multiple attribute assignments

Beyond the rules discussed above for precedence, there is an additional precedence issue that affects the props.conf file alone. Since props.conf sets attributes that are used to govern processing of individual events, and these attributes can be wrapped into stanzas that link to events based on each event's particular host, source or sourcetype, it is possible for an event to have the same attribute set differently for its host or for its sourcetype. If an event has an attribute assignment in a configuration file based on the source and the same attribute is also specified for the event's host, there is a conflict without precedence rules.

The precedence order is:

• source
• host
• sourcetype

• Was this topic useful?
• Post a comment