Deployment Architecture
Highlighted

Why is my timezone configuration in the app directory for my search head cluster being ignored?

Contributor

I'm trying to set the timezone via a deployable app to my search head cluster. If I put the configuration in the etc/system/local, it works fine. If it's in the app directory, then it doesn't. I did have a user-prefs.conf in my etc/users directory, but it didn't have the TZ config present and I took it a step further and deleted it. Using find and grep, the file in apps is the only user-prefs.conf that has TZ in it. Can anyone shed light on why Splunk would ignore the configuration even though it shows up in btool?

PS, this is a shcluster, so that's why the file is in default.

TIA,
Todd

Works

/opt/sh2a/etc/system/local/user-prefs.conf [general]
/opt/sh2a/etc/system/local/user-prefs.conf tz = America/NewYork
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf [general
default]
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf appOrder = search
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf default_namespace = $default
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf showWhatsNew = 1

Doesn't work

/opt/sh2a/etc/apps/allshbase/default/user-prefs.conf [general]
/opt/sh2a/etc/apps/allshbase/default/user-prefs.conf tz = America/NewYork
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf [general
default]
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf appOrder = search
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf default_namespace = $default
/opt/sh2a/etc/apps/user-prefs/default/user-prefs.conf showWhatsNew = 1

0 Karma
Highlighted

Re: Why is my timezone configuration in the app directory for my search head cluster being ignored?

Contributor

Same problem with the ui-prefs.conf too. Ended up making a link and it seems to be working, but it doesn't make sense.

0 Karma
Highlighted

Re: Why is my timezone configuration in the app directory for my search head cluster being ignored?

Legend

So there is an actual app that is distributed with Splunk named user-prefs

$SPLUNK_HOME/etc/apps/user-prefs

I believe that this app gets some special treatment, that affects the order of precedence. See this description of user-prefs.conf in the Admin manual.

0 Karma
Highlighted

Re: Why is my timezone configuration in the app directory for my search head cluster being ignored?

Ultra Champion
Highlighted

Re: Why is my timezone configuration in the app directory for my search head cluster being ignored?

Contributor

Interesting, I'll try and make my app global. Thank you for pointing out that post.

0 Karma
Highlighted

Re: Why is my timezone configuration in the app directory for my search head cluster being ignored?

Contributor

Setting the app to global worked. Thanks!

0 Karma
Highlighted

Re: Why is my timezone configuration in the app directory for my search head cluster being ignored?

Motivator

Cool. My first forum cross-reference. 🙂