All Apps and Add-ons

Share props.conf into two different apps

llacoste
Path Finder

Hello all,

I am not sure what I am asking for is doable or not but here it is:

I would like to be able to share some configurations in between apps. For example the field extraction.

I would have app A with a field extraction up to date and app B "calling" the props.conf file from App A.

That way any time I am changing things into App A, App B would benefit those enhancements.

I am not talking about global sharing the knowledge objects here as I don't want those extracted fields to be available in ALL my apps, but only between A and B.

Is there any way to do this ? any configuration like in App B:
include AppB:props.conf

Something like this?

Thanks for your help guys!

1 Solution

jkat54
SplunkTrust
SplunkTrust

In /AppB/metadata/default.meta or local.meta in AppB add this:

 []
 import = AppA

[] likely exists already so just add the import underneath, save and restart.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

In /AppB/metadata/default.meta or local.meta in AppB add this:

 []
 import = AppA

[] likely exists already so just add the import underneath, save and restart.

0 Karma

llacoste
Path Finder

Hi,
Thanks for the tips, I will try to use that and see if it's working. That would be awesome.
Cheers

0 Karma

somesoni2
Revered Legend

I'm afraid it's not possible. The scope of a knowledge object in Splunk (managed by sharing permissions dialog) is within that app Or all apps.

llacoste
Path Finder

Hi,

Thanks for the answer.
I was quite a bit afraid of that, yes... but as I am always told that Splunk is magic and we can do everything... I started believing so ahah!

Maybe there is a hidden conf we are not aware of...

I will let this thread one day and see if somebody comes up with a miracle, otherwise I'll close it

Thanks again for your help.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...