Getting Data In

Fundamental issue with Splunk's architecture for overwriting other app's configuration

Path Finder

I don't understand why Splunk implemented a priority architecture which can overwrite another app's property. I wanted to blacklist each app's csvs and i used the Stanzas as below in distsearch.conf. To my suprise, one of the apps csvs were not blacklisted.

excludeLookup = apps/app1_kpi/lookups/*.csv

excludeLookup = apps/app2_kpi/lookups/*.csv

Both are global sharing. We changed the sharing but got same result.

Will Splunk change this architecture in future? This is very dangerous for managing. The app concept is fundamental violated.

0 Karma


To work around this, make sure the names are unique, like this:


App1_excludeLookup = apps/app1_kpi/lookups/*.csv


App2_excludeLookup = apps/app2_kpi/lookups/*.csv
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...