Splunk Enterprise

How to set allow_skew globally, but override for one app?

DATEVeG
Path Finder

Hi,

we would like to set allow_skew =15% globally for all of our searches, except for searches which reside in one specific app b. How do i do that?

 

We tried to set a global value in apps/a/default/savedsearches.conf

 

[default]
allow_skew=15%

 

 

And then a add specific configuration in app b to override the global default (apps/b/local/savedsearches.conf)

 

[default]
allow_skew=0

 

 

But it doesn't work. btool shows, that the setting in b/local/savedsearches.conf wins over apps/a/default/savedsearches.conf.

 

According to Configuration file precedence - Splunk Documentation savedsearches.conf is per app/user configuration file. Adding a default.meta for app b with

 

[savedsearches]
export=none

 

also didn't help.

 

Is there a bug or am i missing something?

For reference the link to the official documentation: Offset scheduled search start times - Splunk Documentation

 

Thanks!

- Lorenz

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

If you don't run it with --app=<myapp> you'll get a resulting config in global context, not in app's context.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Did you run your btool with an app context? Otherwise it can be misleading.

0 Karma

DATEVeG
Path Finder

I did run btool with --debug

Where exactly is it misleading?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you don't run it with --app=<myapp> you'll get a resulting config in global context, not in app's context.

DATEVeG
Path Finder

Thank you for this hint!

Seems it's working fine, it was me having problems in using btool correctly.

 

If you use btool with "--app" it won't show settings inherited from other apps.

 

But if you use Splunk Web UI, you can see all the values if you use the advanced edit view.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...