Fundamental issue with Splunk's architecture for overwriting other app's configuration

sibbsnb — Thu, 19 Jun 2014 19:11:25 GMT

I don't understand why Splunk implemented a priority architecture which can overwrite another app's property. I wanted to blacklist each app's csvs and i used the Stanzas as below in distsearch.conf. To my suprise, one of the apps csvs were not blacklisted.

App1:
[replicationBlacklist]
excludeLookup = apps/app1_kpi/lookups/*.csv

App2:
[replicationBlacklist]
excludeLookup = apps/app2_kpi/lookups/*.csv

Both are global sharing. We changed the sharing but got same result.

Will Splunk change this architecture in future? This is very dangerous for managing. The app concept is fundamental violated.

Re: Fundamental issue with Splunk's architecture for overwriting other app's configuration

matt_harden — Thu, 26 Mar 2015 19:30:18 GMT

To work around this, make sure the names are unique, like this:

app1_kpi/default/distsearch.conf:

[replicationBlacklist]
App1_excludeLookup = apps/app1_kpi/lookups/*.csv

app2_kpi/default/distsearch.conf:

[replicationBlacklist]
App2_excludeLookup = apps/app2_kpi/lookups/*.csv

topic Re: Fundamental issue with Splunk's architecture for overwriting other app's configuration in Getting Data In

Fundamental issue with Splunk's architecture for overwriting other app's configuration

Re: Fundamental issue with Splunk's architecture for overwriting other app's configuration