Regex for Distributed Search Blacklist Not Working

[tkreiner]

I downloaded version 1.4.0 of the app and was reviewing the configurations before deploying to a search head in our distributed environment. I saw the distsearch.conf configuration set to keep the app from being included in the replication bundle. However, when I deployed to the search head that it was needed on, the app included itself in the bundle and this pushed us over our limit. I quickly uninstalled and cleaned up the replication bundles.

Last night I downloaded the app to my laptop to do some more testing and I saw that 1.4.1 was released. I noticed that there were changes to the distsearch.conf which indicates that this issue was previously noted. However, even with these changes, I still saw the app included in the replication bundle.

I did some of my own testing today and I found that the following regex does work for the configuration:

apps[\\/]Splunk_Security_Essentials[\\/]...

This was tested on a Linux server, running Splunk version 6.4.3. The regex should cover the path separators for both a Windows and Linux environment. However, I don't have the setup to test in Windows myself.

I wanted to suggest this as a fix to the current version and post it in case others are having the same issue.

[David]

Apologies for the delay on this -- apparently I'm not getting notifications about answers anymore..

So the goal is actually that we do send over the app, but not the lookups. That was a bug in version 1.0, where I had a configuration much like yours. Live searches (not the demo searches) would not work because the app wasn't in the bundle (the search just failed). Ultimately my goal is not to prevent the app from being in the bundle, just to prevent the lookups from being in the bundle. I was able to confirm in my test environment that this was the case with the configuration we ship out of the box, though if you see any different behavior then I definitely would like to know it!

Here's the out of the box config for anyone else who happens by:

[replicationBlacklist]
excludeSSE1 = ...Splunk_Security_Essentials/lookups...
excludeSSE2 = ...Splunk_Security_Essentials\\lookups...

Again, sorry for the delay!