Configuration Tracker - Linux Symbolic Link App Folder

[Solev]

Hello together,

with the introduction of the new ConfigurationTracker in Splunk 9.0 we noticed that some of our apps are not being logged.

The system is a linux single splunk enterprise server and the apps which are not being logged are not directly located under /opt/splunk/etc/apps.

Instead we do only have symbolic links to another folder on the system. It works for everything else, but the configuration tracker seems to ignore symbolic links. It is also not a permission issue of the linked folder. The linked folder has the same splunk group and permissions assigned.

/opt/splunk/etc/apps/symboliclinkapp     ->   /anotherfolder/symboliclinkapp

Is there an option to change the configuration tracker to also consider symbolic links?

[PickleRick · Accepted solution]

The only available options for the configuration tracker are here:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#Configuration_Change_Tracker

It doesn't mention whether the config change tracker follows symlinks or not. If your experience shows that it doesn't, it means it probably doesn't and you can't change that. (I didn't test it myself).

You can submit an idea on https://ideas.splunk.com/