Configurations in different locations merge behind the scenes into one super-configuration. Luckily, the merging happens in a predictable way and is fairly easy to learn; there is also a tool to help us preview this merging.
The configuration merging logic
The merging order
The merging order is slightly different depending on whether the configuration is being used by the search engine or another part of Splunk. The difference is whether there is an active user and app.
The merging order outside of search
Configurations being used outside of search are merged in a fairly simple order....
