Splunk Enterprise

How to set allow_skew globally, but override for one app?

DATEVeG
Path Finder

Hi,

we would like to set allow_skew =15% globally for all of our searches, except for searches which reside in one specific app b. How do i do that?

 

We tried to set a global value in apps/a/default/savedsearches.conf

 

[default]
allow_skew=15%

 

 

And then a add specific configuration in app b to override the global default (apps/b/local/savedsearches.conf)

 

[default]
allow_skew=0

 

 

But it doesn't work. btool shows, that the setting in b/local/savedsearches.conf wins over apps/a/default/savedsearches.conf.

 

According to Configuration file precedence - Splunk Documentation savedsearches.conf is per app/user configuration file. Adding a default.meta for app b with

 

[savedsearches]
export=none

 

also didn't help.

 

Is there a bug or am i missing something?

For reference the link to the official documentation: Offset scheduled search start times - Splunk Documentation

 

Thanks!

- Lorenz

Labels (2)
0 Karma
1 Solution

PickleRick
Ultra Champion

If you don't run it with --app=<myapp> you'll get a resulting config in global context, not in app's context.

View solution in original post

PickleRick
Ultra Champion

Did you run your btool with an app context? Otherwise it can be misleading.

0 Karma

DATEVeG
Path Finder

I did run btool with --debug

Where exactly is it misleading?

0 Karma

PickleRick
Ultra Champion

If you don't run it with --app=<myapp> you'll get a resulting config in global context, not in app's context.

DATEVeG
Path Finder

Thank you for this hint!

Seems it's working fine, it was me having problems in using btool correctly.

 

If you use btool with "--app" it won't show settings inherited from other apps.

 

But if you use Splunk Web UI, you can see all the values if you use the advanced edit view.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...