Getting Data In

Fundamental issue with Splunk's architecture for overwriting other app's configuration

sibbsnb
Path Finder

I don't understand why Splunk implemented a priority architecture which can overwrite another app's property. I wanted to blacklist each app's csvs and i used the Stanzas as below in distsearch.conf. To my suprise, one of the apps csvs were not blacklisted.

App1:
[replicationBlacklist]
excludeLookup = apps/app1_kpi/lookups/*.csv

App2:
[replicationBlacklist]
excludeLookup = apps/app2_kpi/lookups/*.csv

Both are global sharing. We changed the sharing but got same result.

Will Splunk change this architecture in future? This is very dangerous for managing. The app concept is fundamental violated.

0 Karma

matt_harden
Engager

To work around this, make sure the names are unique, like this:

app1_kpi/default/distsearch.conf:

[replicationBlacklist]
App1_excludeLookup = apps/app1_kpi/lookups/*.csv

app2_kpi/default/distsearch.conf:

[replicationBlacklist]
App2_excludeLookup = apps/app2_kpi/lookups/*.csv
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...