Getting Data In

Is the Active Directory group name specified in authentication.conf case sensitive, and what will happen if we have 2 indexes with the same name in indexes.conf?

hemendralodhi
Contributor

Hi Fellow Splunkers,

I have two questions:

1) Is the Active Directory group name specified in authentication.conf case sensitive? I mean, do we have to specify the same name that is used to create the group on the AD server?

2) What will happen if we specify same index name and related config in indexes.conf file on the cluster master and run the splunk apply cluster-bundle command?

Thanks in advance

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Answer 1. No, nothing in LDAP/AD is case sensitive to my knowledge.

Answer 2. What do you mean by "same index name"? You cant have two indexes named the same. As to what will happen, Splunk will take the last lines of the config that were duplicates.

Example 1

.../master-apps/_cluster/local/indexes.conf begins...

[index1]
maxDataSizeMB = 100

...more indexes here...

[index1]
maxDataSizeMB = 2000

... end of file ...

Splunk will use maxDataSizeMB = 2000

  Example 2

  .../master-apps/_cluster/**DEFAULT**/indexes.conf begins...

  [index1]
  maxDataSizeMB = 2000

  ....end of file....

  .../master-apps/_cluster/**LOCAL**/indexes.conf begins...

  [index1]
  maxDataSizeMB = 100

  ....end of file....

Splunk will use maxDataSizeMB = 100

http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Updatepeerconfigurations

View solution in original post

vliggio
Communicator

LDAP group names ARE case sensitive to Splunk (but not to LDAP or AD, which are case aware, not case sensitive). If you put in the group in the incorrect case, they will be ignored by Splunk.

jkat54
SplunkTrust
SplunkTrust

Answer 1. No, nothing in LDAP/AD is case sensitive to my knowledge.

Answer 2. What do you mean by "same index name"? You cant have two indexes named the same. As to what will happen, Splunk will take the last lines of the config that were duplicates.

Example 1

.../master-apps/_cluster/local/indexes.conf begins...

[index1]
maxDataSizeMB = 100

...more indexes here...

[index1]
maxDataSizeMB = 2000

... end of file ...

Splunk will use maxDataSizeMB = 2000

  Example 2

  .../master-apps/_cluster/**DEFAULT**/indexes.conf begins...

  [index1]
  maxDataSizeMB = 2000

  ....end of file....

  .../master-apps/_cluster/**LOCAL**/indexes.conf begins...

  [index1]
  maxDataSizeMB = 100

  ....end of file....

Splunk will use maxDataSizeMB = 100

http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Updatepeerconfigurations

hemendralodhi
Contributor

Thanks jkat54, this was very helpful in understanding this.

0 Karma

jkat54
SplunkTrust
SplunkTrust

YVW. Understanding which config file will take precedence can be tricky.

Hence the need for some sort of "Debug" command. Alas one exists!

./splunk cmd btool indexes list --debug

or

./splunk cmd btool {name of config file here} list --debug

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...