Configuring Splunk - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 275

• attribute : An attribute is a name-value pair. Our attributes in this example
are bar and la . A common synonym is parameter . Keep in mind the
following key points:

° The attribute name must not contain whitespace or the equals sign
° Each attribute belongs to the stanza defined above; if the
attribute appears above all stanzas, the attribute belongs
to the stanza [default]
° The attribute name must be unique in a single stanza but not in
a configuration
° Each attribute must have its own line and can only use one line
° Spaces around the equal sign do not matter

These are a few rules that may not apply in other implementations:

• Stanza and property names are case sensitive
• The comment character is #
• Bare attributes at the top of a file are added to the [default] stanza
• Any attributes in the stanza [default] are added to all stanzas that
do not have an attribute with that name already

Configuration merging logic
Configurations in different locations merge behind the scenes into one "super"
configuration. Luckily, the merging happens in a predictable way and is fairly
easy to learn, and there is a tool to help us preview this merging.

Merging order
Merging order is slightly different depending on whether the configuration is being
used by the search engine or another part of Splunk. The difference is whether there
is an active user and app.

Merging order outside of search
Configurations being used outside of search are merged in a fairly simple order.
These configurations include what files to read, what indexed fields to create,
what indexes exist, and deployment server and client configurations as well
as other settings. These configurations merge in this order:

1.

$SPLUNK_HOME/etc/system/default : This directory contains the base
configurations that ship with Splunk.