I am creating a custom app for my company and I have put user-prefs.conf in default. The SHC always complains about this file when push a bundle and a restart is required. Am I not supposed to house this file within an app, does it need to go in etc/system/local?
Any help is much appreciated becauase at this point I cannot do a rolling restart of my SHC.
Is the role that your user-prefs.conf not deployed to you SHC? What is the error that SHC is barking about?
I my SHC I package the user-prefs.conf in a separate package to deploy to SHC. Any changes I make them there.
In our case, we use
$SPLUNK_HOME/etc/shcluster/apps/user-prefs/local/user-prefs.conf on the deployer to map the splunk roles to the default_namespace - an app.
-- To use one or more of these configurations, copy the configuration block into user-prefs.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
Yes the roles exist:
[general_default] default_earliest_time = -1h default_latest_time = now [role_predix-ops-user] default_namespace = GE_Predix_App [role_predix-sec-user] default_namespace = GE_Predix_App [role_predix-admin] default_namespace = launcher
Is there something wrong with the file? In there an issue with the general_default section? The roles exist in the same app actually:
[role_predix-admin] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 importRoles = admin srchIndexesAllowed = *;_* srchIndexesDefault = * srchMaxTime = 0 [role_predix-sec-user] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 importRoles = user srchIndexesAllowed = *;_* srchIndexesDefault = *_security srchMaxTime = 0 [role_predix-ops-user] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 importRoles = user srchIndexesAllowed = *_predix_*;_*;last_chance_predix srchIndexesDefault = *_predix_* srchMaxTime = 30d srchJobsQuota = 15 rtSrchJobsQuota = 1
Any insight is much appreaciated!