Knowledge Management

Exporting knowledge objects from Splunk_TA_nix?

daniel333
Builder

All,

I just installed Splunk_TA_nix and noticed that it's tags are quite expensive. I'd like to limit the knowledge object to searching and reporting and "MyCustomApp". How would I copy and modify default.meta in that situation?

 vi default.meta
# Application-level permissions
[]
access = read : [ * ], write : [ admin ]
export = system

[savedsearches]
owner = admin

## Exclude export of custom alert actions
[alert_actions/email]
export = none
0 Karma

hettervik
Builder

I don't know if it's possible to export knowledge objects to certain apps. As far as I know is either "global" or nothing. However, if you haven't done so already, you should try to edit tags.conf and possibly eventtypes.conf to optimize the tagging. Make sure that the searches only search in relevant indexes, at least.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...