Hi @mufthmu,
at first, did you followed all the steps in app creation ( https://dev.splunk.com/enterprise/docs/releaseapps/packagingtoolkit )?
probably there's an error in app creation (there must be two embedded tars: the first having as output tar extension and the second tar.gz extension).
You can test if it's all ok, copying the untared app in $SPLUNK_HOME/etc/apps folder and restarting Splunk: if it runs there's an error in tar, if instead it continuea to not work there's a problem in knowledge objects.
Anyway, It isn't a good practice to use the Search App for dashboards or alerts.
At the same time It isn't a good idea to have dashboards and alerts in different apps because you have to duplicate knowledge objects (fields, eventtypes, etc...) or to share them between apps.
The best approach is to have different apps for different uses cases and if you have different objects, or grants.
When I have to do dashboards or alerts, I usually create a new app (an app is an empty container!) and I create all my knowledge objects inside the app so it's easy to move and to manage it.
Ciao.
Giuseppe
