What is the order of precedence (from lowest → highest ) within serverclass.

The serverclass.conf file controls how deployment apps and configurations are distributed from the Deployment Server to its Deployment Clients . Within this configuration, attribute values can be defined at multiple levels, and Splunk applies them based on a defined order of precedence — from general to most specific.

The correct order of evaluation (lowest to highest precedence) is:

[global] — applies to all server classes and clients unless overridden.

[serverClass: < name > ] — applies to all clients in that specific server class.

[serverClass: < name > :app: < appname > ] — applies only to a specific app within that server class and overrides previous settings.

This means that values set in the [serverClass: < name > :app: < appname > ] stanza take priority over those in [serverClass: < name > ], which in turn override values in [global] .

Example (from serverclass.conf):

[global]

whitelist.0 = *

[serverClass:web_servers]

whitelist.0 = web01*

blacklist.0 = test*

[serverClass:web_servers:app:web_monitoring]

restartSplunkWeb = true

Here, restartSplunkWeb = true in the app stanza overrides any inherited setting from the global or class level.

Reference (Splunk Documentation):

Splunk® Enterprise Admin Manual → Deploy configurations using deployment server

serverclass.conf.spec and example → “Precedence of attributes: global < serverClass: < name > < serverClass: < name > :app: < appname > ”

Splunk Docs: “How the deployment server works”