You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?
Trap 1: The file with the largest size
File size has no impact on precedence.
Trap 2: It randomly chooses one
Splunk is deterministic in its configuration processing.
Trap 3: The file created most recently
Timestamp is not used for precedence tie-breaking.
- A
The file with the largest size
Why it fails: File size has no impact on precedence.
- B
It randomly chooses one
Why it fails: Splunk is deterministic in its configuration processing.
- C
The file sorted alphabetically by name
When stanzas share identical precedence, Splunk resolves the conflict by loading configuration files in reverse alphabetical order, so the file sorting last alphabetically takes effect. This satisfies the stem's requirement for determining the winning stanza.
- D
The file created most recently
Why it fails: Timestamp is not used for precedence tie-breaking.