A customer has downloaded the Splunk App for AWS from Splunkbase and installed it in a search head cluster following the instructions using the…

Splunk's configuration system operates on a file precedence hierarchy. When a power user modifies and saves a dashboard within an app, a copy of that dashboard's configuration is saved in their specific user directory (etc/users///local/). This user-specific configuration has a higher precedence for that user than the app-level configurations located in etc/apps//. When the app is upgraded via the deployer, the app-level files are updated, but the user's private, modified copy remains untouched. Consequently, the power user will continue to see their own modified version of the dashboard, not the newly deployed one.

A. The user's modification is stored in their private directory and does not create a conflict that prevents the global deployment of the app bundle to other users.

B. The search head cluster bundle application process updates the app-level directories and is not affected by files in individual user directories; therefore, it will not fail.

C. Due to configuration file precedence, the user's private, modified version of the dashboard will be loaded instead of the updated app-level version.

1. Splunk Enterprise Documentation, Admin Manual, "Configuration file precedence": This document outlines the order in which Splunk loads configuration files. It explicitly states that user-specific directories (.../etc/users///local) take precedence over app-level directories (.../etc/apps//local and .../etc/apps//default). This directly supports the conclusion that the user will see their own version.

2. Splunk Enterprise Documentation, Distributed Search, "Use the deployer to distribute apps and configuration updates": This section details how the deployer pushes a bundle to the $SPLUNKHOME/etc/shcluster/apps/ directory on cluster members. The process overwrites the existing app configurations at the app level but does not interact with or fail due to configurations in user-specific directories, invalidating options A and B.

3. Splunk Enterprise Documentation, Knowledge Manager Manual, "Manage knowledge object permissions": This manual explains that when users with sufficient permissions edit a shared knowledge object (like a dashboard), they can save changes privately. This action creates the user-specific copy in their directory, which is the foundational event described in the question scenario.