Exam SPLK-1003 Topic 13 Question 117 Discussion

The serverclass.conf file controls how deployment apps and configurations are distributed from the Deployment Server to its Deployment Clients. Within this configuration, attribute values can be defined at multiple levels, and Splunk applies them based on a defined order of precedence - from general to most specific.
The correct order of evaluation (lowest to highest precedence) is:
* [global] - applies to all server classes and clients unless overridden.
* [serverClass:<name>] - applies to all clients in that specific server class.
* [serverClass:<name>:app:<appname>] - applies only to a specific app within that server class and overrides previous settings.
This means that values set in the [serverClass:<name>:app:<appname>] stanza take priority over those in
[serverClass:<name>], which in turn override values in [global].
Example (from serverclass.conf):
[global]
whitelist.0 = *
[serverClass:web_servers]
whitelist.0 = web01*
blacklist.0 = test*
[serverClass:web_servers:app:web_monitoring]
restartSplunkWeb = true
Here, restartSplunkWeb = true in the app stanza overrides any inherited setting from the global or class level.
Reference (Splunk Documentation):
* Splunk Enterprise Admin Manual # Deploy configurations using deployment server
* serverclass.conf.spec and example # "Precedence of attributes: global < serverClass:<name> < serverClass:<name>:app:<appname>"
* Splunk Docs: "How the deployment server works"