Configuring Splunk - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 279

[foo]
bar= 15
[cars]
ferrari =0
The resulting configuration would be:
[foo]
bar=15
la=20
[pets]
cat=blue
dog=rex
Dog=fido
fish=bubbles
[cars]
ferrari=0
Things to notice in this example:
• The order of the stanzas does not matter
• The spaces around the equal signs do not matter
• Dog does not override dog as all stanza names and property names are
case sensitive
• The cars stanza is added fully
Configuration merging example 3
Let's do a little exercise, merging four configurations from different locations.
In this case, we are not in search, so we will use the rules from the Merging order
outside of search section. Let's step through a few sample configurations:
• For $SPLUNK_HOME/etc/apps/d/default/props.conf we have:
[web_access]
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_PREFIX = ^\[
[source::*.log]
BREAK_ONLY_BEFORE_DATE = true