Splunk Enterprise

How to set allow_skew globally, but override for one app?

DATEVeG
Path Finder

Hi,

we would like to set allow_skew =15% globally for all of our searches, except for searches which reside in one specific app b. How do i do that?

 

We tried to set a global value in apps/a/default/savedsearches.conf

 

[default]
allow_skew=15%

 

 

And then a add specific configuration in app b to override the global default (apps/b/local/savedsearches.conf)

 

[default]
allow_skew=0

 

 

But it doesn't work. btool shows, that the setting in b/local/savedsearches.conf wins over apps/a/default/savedsearches.conf.

 

According to Configuration file precedence - Splunk Documentation savedsearches.conf is per app/user configuration file. Adding a default.meta for app b with

 

[savedsearches]
export=none

 

also didn't help.

 

Is there a bug or am i missing something?

For reference the link to the official documentation: Offset scheduled search start times - Splunk Documentation

 

Thanks!

- Lorenz

Labels (2)
0 Karma
1 Solution

PickleRick
Ultra Champion

If you don't run it with --app=<myapp> you'll get a resulting config in global context, not in app's context.

View solution in original post

PickleRick
Ultra Champion

Did you run your btool with an app context? Otherwise it can be misleading.

0 Karma

DATEVeG
Path Finder

I did run btool with --debug

Where exactly is it misleading?

0 Karma

PickleRick
Ultra Champion

If you don't run it with --app=<myapp> you'll get a resulting config in global context, not in app's context.

DATEVeG
Path Finder

Thank you for this hint!

Seems it's working fine, it was me having problems in using btool correctly.

 

If you use btool with "--app" it won't show settings inherited from other apps.

 

But if you use Splunk Web UI, you can see all the values if you use the advanced edit view.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...