SPLK-1003 · Domain 3 of 17

SPLK-1003 Domain 3: Splunk Configuration Files

Configuration files drive every Splunk setting. This topic tests where .conf files live, how copies merge into one effective configuration, which copy wins in a conflict, and how to prove the result with btool.

Exam weight
5%
Official objectives
4
Estimated questions estimate
~3
Suggested study time estimate
4–6 hrs

About 10 min read Reviewed October 2026

Overview

Domain 3 has four official objectives: describe the configuration directory structure, understand configuration layering, understand configuration precedence, and use btool to examine settings. The structure covers default and local directories under etc/system, etc/apps and etc/users. Layering explains how Splunk merges every copy of a file, such as inputs.conf, into one runtime view. Precedence decides which value wins when copies disagree, and the answer depends on whether the setting is evaluated in global context or in app and user context.

The weight is 5%, around three questions, but configuration file logic underpins inputs, parsing, transforms and roles later in the blueprint. A clear grip on precedence and btool turns many troubleshooting questions into simple lookups.

How it's tested

Items typically show two or three file paths that set the same attribute and ask which value takes effect, or they describe a change that did not apply and ask how to confirm the effective setting. Others test which directory an admin should edit and why default directories are off limits.

  • Which value wins

    Two paths define the same attribute and you choose the effective value using global or app and user precedence.

  • Where to edit

    You decide the correct directory for a change so it survives upgrades and applies in the intended context.

  • Prove it with btool

    A setting misbehaves and you select the btool command that shows the merged value and its source file.

Reasoning it through

inputs.conf sets index = web in etc/apps/web_inputs/local and index = main in etc/system/local. Inputs are evaluated in global context, where system/local has the highest precedence, so events go to main. A candidate who applies app-context rules would pick web, which is wrong here. Running splunk btool inputs list --debug would confirm the winning file.

Objectives 4

Official objectives from the Splunk outline, in outline order.

3.1 Describe Splunk configuration directory structureDefault and local directories under etc/system, etc/apps and etc/users.
What it means
Splunk stores configuration in .conf files under $SPLUNK_HOME/etc. The system directory holds etc/system/default, shipped by Splunk, and etc/system/local for site-wide overrides. Each app has its own default and local directories under etc/apps/<app>. Per-user, per-app settings created through Splunk Web are saved under etc/users/<user>/<app>/local.
What to understand
Know that default directories belong to Splunk or the app developer and are replaced on upgrade, so admins edit local copies only. Local files hold only the attributes you change, not a full copy. Apps are the preferred way to package configuration because they can be deployed and removed cleanly.
How it shows up
You choose the directory where a change should be made or identify which directory a given file belongs to.
Common confusion
Editing files in a default directory, which an upgrade or app update will overwrite.
3.2 Understand configuration layeringHow Splunk merges all copies of a .conf file into one effective configuration.
What it means
At startup and on reload, Splunk reads every copy of a configuration file from every directory and merges them. Stanzas with the same name are combined attribute by attribute, so a local file can override a single setting without repeating the rest. The result is one effective configuration per file in memory.
What to understand
Layering is about combination; precedence is about conflict. Attributes that appear in only one copy are simply added. Only when the same attribute appears in the same stanza in more than one place does precedence decide the winner. Many settings need a restart or reload to be re-merged.
How it shows up
A scenario shows partial stanzas in several files and asks what the merged stanza contains.
Common confusion
Thinking a local file must duplicate a full stanza or it replaces the whole default stanza.
3.3 Understand configuration precedenceGlobal versus app and user context ordering.
What it means
Precedence is the ordering Splunk uses when copies conflict. In global context, used for indexing and input settings, the order is etc/system/local, then app local directories, then app default directories, then etc/system/default. In app and user context, used for search-time knowledge objects, the current user's directory for the app wins, then the current app, then other apps that export objects, then system directories.
What to understand
Identify the context first. inputs.conf, outputs.conf, indexes.conf and index-time props.conf settings use global context. Search-time field extractions, saved searches and views use app and user context. Among apps in global context, directory names are compared in ASCII order, with uppercase sorting before lowercase. Within a file, a more specific stanza such as a host or source stanza can outrank a sourcetype stanza in props.conf.
How it shows up
Given conflicting values in different paths, you must state which one takes effect and why.
Common confusion
Applying search-time ordering, where the user directory wins, to an index-time or input setting.
3.4 Use btool to examine configuration settingsViewing merged configuration and source files from the command line.
What it means
btool is a command-line tool that shows the merged, on-disk configuration for a given file. Running splunk btool inputs list prints the effective stanzas, and adding --debug shows which file supplied each line. splunk btool check reports typos and invalid stanzas.
What to understand
btool reads files on disk, so it shows what Splunk would use after a restart, not necessarily what the running process has loaded. Options such as --app and --user narrow the context. It is the standard first step when a configuration change does not behave as expected.
How it shows up
A configuration change has no effect and you choose the command that reveals the winning file.
Common confusion
Assuming btool reports the in-memory running configuration rather than the merged files on disk.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Default versus local

    Default ships with Splunk or an app; local holds your changes.

    Remember
    Never edit default directories.
    Tested as
    Directory questions.
    Trap
    Copying the whole default file into local.

  • etc/system/local

    Site-wide local overrides.

    Remember
    Highest precedence in global context.
    Tested as
    Precedence questions.
    Trap
    Assuming app local always wins.

  • etc/users

    Per-user, per-app settings saved from Splunk Web.

    Remember
    Highest precedence in app and user context.
    Tested as
    Search-time precedence items.
    Trap
    Applying it to inputs.

  • Layering

    Merging all copies of a file into one effective view.

    Remember
    Attributes add together; conflicts use precedence.
    Tested as
    Merged stanza questions.
    Trap
    Thinking local replaces a stanza wholesale.

  • Global context

    Used for inputs, outputs, indexes and index-time settings.

    Remember
    system/local > app local > app default > system/default.
    Tested as
    Index-time precedence.
    Trap
    Using user-first ordering.

  • App and user context

    Used for search-time knowledge objects.

    Remember
    User directory, then app, then exported objects, then system.
    Tested as
    Search-time precedence.
    Trap
    Using global ordering for searches.

  • ASCII app ordering

    Apps are ranked by directory name in global context.

    Remember
    Uppercase sorts before lowercase; A before Z.
    Tested as
    App conflict questions.
    Trap
    Assuming install order matters.

  • splunk btool <file> list --debug

    Shows merged settings with the source file for each line.

    Remember
    Reads disk, not memory.
    Tested as
    Troubleshooting items.
    Trap
    Forgetting --debug when the source is needed.

  • splunk btool check

    Checks configuration files for errors and typos.

    Remember
    Useful before restarting.
    Tested as
    Validation questions.
    Trap
    Confusing it with btprobe.

  • Restart or reload

    Many configuration edits need a restart or a reload to take effect.

    Remember
    btool shows disk state either way.
    Tested as
    Change-not-applied scenarios.
    Trap
    Expecting edits to apply instantly.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Global versus app and user context

ConceptMeaningKey differenceCommon trap
Global context Inputs, indexing and other instance-wide settings system/local wins Using user-first ordering
App and user context Search-time knowledge objects User directory wins Using system/local-first ordering

Configuration tools and locations

ConceptMeaningKey differenceCommon trap
Default directory Vendor or app-supplied files Overwritten on upgrade Editing it directly
Local directory Admin changes Survives upgrades Duplicating full stanzas
btool list --debug Merged view with source files Reads files on disk Thinking it shows memory
btool check Syntax validation Flags invalid entries Confusing it with list

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. App local beats system local

    What candidates pick
    Pick the app local value for an inputs.conf conflict.
    Why it looks right
    Apps feel more specific than system settings.
    Why it's wrong
    In global context etc/system/local has the highest precedence over any app directory.

    Clue to watch for The setting is an input or index-time attribute.

  2. User wins for indexing

    What candidates pick
    Apply etc/users precedence to an indexes.conf attribute.
    Why it looks right
    User directories win at search time.
    Why it's wrong
    Index and input settings are global context, where user directories do not apply.

    Clue to watch for The file is indexes.conf or inputs.conf.

  3. Edit the default file

    What candidates pick
    Change the attribute directly in default.
    Why it looks right
    That is where the setting already appears.
    Why it's wrong
    Upgrades overwrite default directories, so changes belong in local.

    Clue to watch for The question mentions surviving upgrades.

  4. btool shows memory

    What candidates pick
    Use btool to confirm a change is active without restarting.
    Why it looks right
    btool reports the merged configuration.
    Why it's wrong
    btool reads files on disk, so a change can appear there before Splunk has loaded it.

    Clue to watch for The scenario has not restarted Splunk.

  5. Install order decides

    What candidates pick
    Say the most recently installed app wins.
    Why it looks right
    Recent changes feel like they should apply.
    Why it's wrong
    Between apps in global context, Splunk compares directory names in ASCII order.

    Clue to watch for Two apps set the same attribute.

Answer framework

Resolve a configuration conflict with this sequence before choosing an answer.

  1. List every path that defines the attribute and note whether each is a default or a local directory under system, apps or users.
  2. Classify the setting as global context, such as inputs, outputs, indexes or index-time props, or as app and user context for search-time objects.
  3. Apply the matching precedence order, and between apps in global context compare directory names in ASCII order.
  4. Check stanza specificity in files like props.conf, where host and source stanzas can outrank sourcetype stanzas.
  5. Confirm with splunk btool <file> list --debug, and restart or reload if the running instance has not yet picked up the change.

Practice question

On an indexer, outputs and inputs work, but a new monitor stanza in etc/apps/acme_inputs/local/inputs.conf sets sourcetype = acme_log while etc/system/local/inputs.conf sets sourcetype = generic for the same stanza. Which sourcetype will events receive?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Treat this topic as a short set of rules you must apply under pressure. Write out both precedence orders on a card, global context on one side and app and user context on the other, and list which common files use each. Review the card until you can produce it without hesitation.

Then practise in a lab. Create the same inputs.conf attribute in etc/system/local and in a test app's local directory, run splunk btool inputs list --debug, and see which file wins. Repeat with two apps whose names differ in case to see ASCII ordering. Create a saved search as a user to watch Splunk Web write to etc/users.

Finish by solving conflict scenarios on paper: write three paths, decide the context and name the winner. Because later topics on inputs, props.conf and transforms.conf all depend on precedence, revisit this card whenever you study those domains, and treat btool as your default troubleshooting answer.

FAQ

How much of SPLK-1003 is Splunk Configuration Files?

Splunk Configuration Files is 5% of the exam, about three questions, covering directory structure, layering, precedence and btool.

Which directory has the highest precedence?

It depends on context. In global context it is etc/system/local; in app and user context it is the user's directory for the current app.

What is the difference between layering and precedence?

Layering merges all copies of a file. Precedence decides which value wins only when the same attribute conflicts.

Why should I not edit default directories?

Splunk and app updates overwrite them, so your changes would be lost. Put changes in local directories or in your own app.

What does btool --debug add?

It prints the file path that supplied each line of the merged configuration, which shows exactly where a setting comes from.

Does every change need a restart?

Many index-time and input changes need a restart, while some settings can be reloaded through endpoints or Splunk Web. btool shows disk state regardless.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have studied configuration directories, layering, precedence and btool. Test whether you can resolve file conflicts quickly and accurately.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going