Knowledge Management

Configuration Tracker - Linux Symbolic Link App Folder

Solev
Explorer

Hello together,

with the introduction of the new ConfigurationTracker in Splunk 9.0 we noticed that some of our apps are not being logged.

 

The system is a linux single splunk enterprise server and the apps which are not being logged are not directly located under /opt/splunk/etc/apps.

Instead we do only have symbolic links to another folder on the system. It works for everything else, but the configuration tracker seems to ignore symbolic links. It is also not a permission issue of the linked folder. The linked folder has the same splunk group and permissions assigned.

 

/opt/splunk/etc/apps/symboliclinkapp     ->   /anotherfolder/symboliclinkapp

 

Is there an option to change the configuration tracker to also consider symbolic links?

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

The only available options for the configuration tracker are here:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#Configuration_Change_Tracker

It doesn't mention whether the config change tracker follows symlinks or not. If your experience shows that it doesn't, it means it probably doesn't and you can't change that. (I didn't test it myself).

You can submit an idea on https://ideas.splunk.com/

 

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The only available options for the configuration tracker are here:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#Configuration_Change_Tracker

It doesn't mention whether the config change tracker follows symlinks or not. If your experience shows that it doesn't, it means it probably doesn't and you can't change that. (I didn't test it myself).

You can submit an idea on https://ideas.splunk.com/

 

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...