Splunk Enterprise

How to set allow_skew globally, but override for one app?

DATEVeG
Path Finder

Hi,

we would like to set allow_skew =15% globally for all of our searches, except for searches which reside in one specific app b. How do i do that?

 

We tried to set a global value in apps/a/default/savedsearches.conf

 

[default]
allow_skew=15%

 

 

And then a add specific configuration in app b to override the global default (apps/b/local/savedsearches.conf)

 

[default]
allow_skew=0

 

 

But it doesn't work. btool shows, that the setting in b/local/savedsearches.conf wins over apps/a/default/savedsearches.conf.

 

According to Configuration file precedence - Splunk Documentation savedsearches.conf is per app/user configuration file. Adding a default.meta for app b with

 

[savedsearches]
export=none

 

also didn't help.

 

Is there a bug or am i missing something?

For reference the link to the official documentation: Offset scheduled search start times - Splunk Documentation

 

Thanks!

- Lorenz

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

If you don't run it with --app=<myapp> you'll get a resulting config in global context, not in app's context.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Did you run your btool with an app context? Otherwise it can be misleading.

0 Karma

DATEVeG
Path Finder

I did run btool with --debug

Where exactly is it misleading?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you don't run it with --app=<myapp> you'll get a resulting config in global context, not in app's context.

DATEVeG
Path Finder

Thank you for this hint!

Seems it's working fine, it was me having problems in using btool correctly.

 

If you use btool with "--app" it won't show settings inherited from other apps.

 

But if you use Splunk Web UI, you can see all the values if you use the advanced edit view.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...