Splunk Enterprise Certified Admin SPLK-1003 Full Course Free

The app local directories move to second in the priority list. This is explained in the Splunk documentation, which states:

In a clustered environment, the precedence of configuration files changes slightly from that of a standalone deployment. The app local directories move to second in the priority list, after the peer-apps local directory. This means that any configuration files in the app local directories on the individual peers are overridden by configuration files of the same name and type in the peer-apps local directory on the master node.

The Splunk indexing process consists of three main phases: Input, Parsing, and Indexing. Understanding these phases is crucial for configuring data inputs and managing data flow within Splunk.

Input Phase: Splunk receives data from various sources, such as files, network ports, or scripted inputs.

Parsing Phase: Splunk breaks the data into individual events, applies transformations, and extracts timestamps.

Indexing Phase: Splunk writes the parsed events to disk and creates indexes for efficient searching.

From the official Splunk documentation:

"The data pipeline consists of three main phases: input, parsing, and indexing."

— How the Splunk platform indexes data - Splunk Documentation

Therefore, the correct order of the indexing process is: Input phase → Parsing phase → Indexing phase.

"You can group your search peers to facilitate searching on a subset of them. Groups of search peers are known as "distributed search groups." You specify distributed search groups in the distsearch.conf file"

The following items in the phases below are listed in the order Splunk applies them (ie LINE_BREAKER occurs before TRUNCATE).

Input phase

inputs.conf

props.conf

CHARSET

NO_BINARY_CHECK

CHECK_METHOD

CHECK_FOR_HEADER (deprecated)

PREFIX_SOURCETYPE

sourcetype

wmi.conf

regmon-filters.conf

Structured parsing phase

props.conf

INDEXED_EXTRACTIONS, and all other structured data header extractions

Parsing phase

props.conf

LINE_BREAKER, TRUNCATE, SHOULD_LINEMERGE, BREAK_ONLY_BEFORE_DATE, and all other line merging settings

TIME_PREFIX, TIME_FORMAT, DATETIME_CONFIG (datetime.xml), TZ, and all other time extraction settings and rules

TRANSFORMS which includes per-event queue filtering, per-event index assignment, per-event routing

SEDCMD

MORE_THAN, LESS_THAN

transforms.conf

stanzas referenced by a TRANSFORMS clause in props.conf

LOOKAHEAD, DEST_KEY, WRITE_META, DEFAULT_VALUE, REPEAT_MATCH