Enterprise Security/PCI not importing TA- and Splunk_TA_ app

[jsmith_splunk]

I built a search head for testing the PCI add-on for ES and have brought 3 data sources into the environment.
The TA-fireeye is operating as expected
The Splunk_TA_cisco-asa is working in Search but field extractions are not showing in ES/PCI
The TA-aruba_syslog (custom TA) is working in Search but field extractions are not showing in ES/PCI

When I run
| rest /servicesNS/nobody/system/apps/local/SplunkEnterpriseSecuritySuite/import splunk_server=local | fields import

I see the TA-fireeye TA but not the other 2. I ran setup for ES again and rebooted, this had no effect. Since the permissions are correct, the names are correct and the extractions are working in Search I'm not sure what else could be causing the issue.

[martin_mueller]

Check if your [app_imports_update://update_es] input is enabled, and if the import regex that defaults to app_regex = ([DST]A-.*)|(Splunk_[DST]A_.*)|(SplunkEnterpriseSecuritySuite) is set as expected without any extra exclusions in app_exclude_regex.
The default regex should certainly match all three TAs.

Once that's confirmed, compare the sharing settings between the three TAs and their field extractions. A common issue would be that fields in the custom TA aren't shared beyond private yet.

[martin_mueller]

Best course of action would be to get a colleague to look at your environment - much more effective than guessing.

[martin_mueller]

Did you check the sharing on the individual objects? Most suspiciously, if you can see fields from asa but not eventtypes then I'd guess eventtypes from asa aren't shared.

Additionally, if all you see for the import is a disabled = 0 then you looked at local, not default.

[jsmith_splunk]

That makes sense, but strangely enough isn't accurate, all of the eventtypes for ASA are shared globally.

You're right, I was looking at the local inputs.conf, the default shows the full app_regex

[jsmith_splunk]

Regarding permissions
Both the Splunk_TA_cisco-asa and TA-aruba_syslog TA's are shared globally.

By default the [app_imports_update://update_es] stanza only contains a disabled = 0 argument.

I added the following to the stanza, adding the 2 missing TA's specifically in a hope to just force the issue, it had no effect.
app_regex = (TA-.)|(Splunk_TA_.)|(sideview_utils)|(SplunkEnterpriseSecuritySuite)|(DA-.)|(SA-.)|(TA-aruba_syslog)|(Splunk_TA_cisco-asa)

I removed my stanza argument and added the one you suggested, after reboot I see the following

Splunk_TA_cisco-asa
Field extractions and Field Aliases are viewable from the PCI context in settings\fields. Eventtypes are not viewable from the PCI context, but are viewable from the Search context

TA-aruba_syslog
Field extractions, aliases, eventtypes are not viewable from the PCI context in settings/fields but are viewable from the Search context