- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Why is my timezone configuration in the app direct...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to set the timezone via a deployable app to my search head cluster. If I put the configuration in the etc/system/local, it works fine. If it's in the app directory, then it doesn't. I did have a user-prefs.conf in my etc/users directory, but it didn't have the TZ config present and I took it a step further and deleted it. Using find and grep, the file in apps is the only user-prefs.conf that has TZ in it. Can anyone shed light on why Splunk would ignore the configuration even though it shows up in btool?
PS, this is a shcluster, so that's why the file is in default.
TIA,
Todd
Works
/opt/sh2a/etc/system/local/user-prefs.conf [general]
/opt/sh2a/etc/system/local/user-prefs.conf tz = America/New_York
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf [general_default]
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf appOrder = search
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf default_namespace = $default
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf showWhatsNew = 1
Doesn't work
/opt/sh2a/etc/apps/all_sh_base/default/user-prefs.conf [general]
/opt/sh2a/etc/apps/all_sh_base/default/user-prefs.conf tz = America/New_York
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf [general_default]
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf appOrder = search
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf default_namespace = $default
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf showWhatsNew = 1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A similar discussion at Is this the correct way to use appOrder in user-prefs.conf on a search head cluster?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cool. My first forum cross-reference. 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Interesting, I'll try and make my app global. Thank you for pointing out that post.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Setting the app to global worked. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So there is an actual app that is distributed with Splunk named user-prefs
$SPLUNK_HOME/etc/apps/user-prefs
I believe that this app gets some special treatment, that affects the order of precedence. See this description of user-prefs.conf in the Admin manual.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same problem with the ui-prefs.conf too. Ended up making a link and it seems to be working, but it doesn't make sense.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
