What is best practice when utilizing a search from the below apps? What pros/cons should I consider from each? I appreciate any guidance here.
1) Enable the search stored in the app?
2) Clone the search and store in a custom company-specific app, and enable there?
DA-ESS-MitreContent |
DA-ESS-ContentUpdate |
Hi @TheBravoSierra,
When I have to use the searches as they are, is I prefer to leave them in their own original app.
If I have to modify them (any update!) I clone them in one my own app.
This is an approch hinted to me by a Splunk Professional Service.
Ciao.
Giuseppe