Splunk Enterprise

How to set allow_skew globally, but override for one app?

DATEVeG
Path Finder

Hi,

we would like to set allow_skew =15% globally for all of our searches, except for searches which reside in one specific app b. How do i do that?

 

We tried to set a global value in apps/a/default/savedsearches.conf

 

[default]
allow_skew=15%

 

 

And then a add specific configuration in app b to override the global default (apps/b/local/savedsearches.conf)

 

[default]
allow_skew=0

 

 

But it doesn't work. btool shows, that the setting in b/local/savedsearches.conf wins over apps/a/default/savedsearches.conf.

 

According to Configuration file precedence - Splunk Documentation savedsearches.conf is per app/user configuration file. Adding a default.meta for app b with

 

[savedsearches]
export=none

 

also didn't help.

 

Is there a bug or am i missing something?

For reference the link to the official documentation: Offset scheduled search start times - Splunk Documentation

 

Thanks!

- Lorenz

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

If you don't run it with --app=<myapp> you'll get a resulting config in global context, not in app's context.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Did you run your btool with an app context? Otherwise it can be misleading.

0 Karma

DATEVeG
Path Finder

I did run btool with --debug

Where exactly is it misleading?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you don't run it with --app=<myapp> you'll get a resulting config in global context, not in app's context.

DATEVeG
Path Finder

Thank you for this hint!

Seems it's working fine, it was me having problems in using btool correctly.

 

If you use btool with "--app" it won't show settings inherited from other apps.

 

But if you use Splunk Web UI, you can see all the values if you use the advanced edit view.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...