File precedence plays an important role while troubleshooting Splunk for an administrator, developer, or architect. All Splunk’s configurations are written within plain text .conf files. Most of the aspect of Splunk's behaviour is determined by these configuration files only.  There can be multiple copies present for each of these files, and thus it is important to know the role these files, during a Splunk instance is running or restarted. For modifying configuration files, the user must know how the Splunk software evaluates those files.   File precedence is an important concept to understand for a number of other reasons as well, some of them are below:  To be able to plan Splunk upgrades  To be able to plan app upgrades  To be able to provide different data inputs   To distribute the configurations during the Splunk deployments.  To determine the priority among copies of a configuration file, Splunk considers the context of each configuration file. Configuration files can either be operated in a) Global or b) For the current application/user.   Directory priority descends as follows when the file context is global:     System local directory -- >highest priority    Application local directories    Application default directories    System default directory --> lowest priority  Directory priority descends from user to application and then to the system when the file context is current application/user:  User directories for the current user -- >highest priority.     Application directories for the currently running application (local, followed by default).   Application directories for all the other applications (local, followed by default) --> for exported settings only.  System directories (local, followed by default) --> lowest priority.