we would like to set allow_skew =15% globally for all of our searches, except for searches which reside in one specific app b. How do i do that?
We tried to set a global value in apps/a/default/savedsearches.conf
And then a add specific configuration in app b to override the global default (apps/b/local/savedsearches.conf)
But it doesn't work. btool shows, that the setting in b/local/savedsearches.conf wins over apps/a/default/savedsearches.conf.
According to Configuration file precedence - Splunk Documentation savedsearches.conf is per app/user configuration file. Adding a default.meta for app b with
also didn't help.
Is there a bug or am i missing something?
For reference the link to the official documentation: Offset scheduled search start times - Splunk Documentation
Thank you for this hint!
Seems it's working fine, it was me having problems in using btool correctly.
If you use btool with "--app" it won't show settings inherited from other apps.
But if you use Splunk Web UI, you can see all the values if you use the advanced edit view.