I am currently testing the Cisco Security Suite dashboards using data collected through the Splunk Add-on for Cisco WSA and I have noticed that some of the searches are not using any of the configuration in props.conf/transforms.conf, but when I run the same search under Search & Reporting, all the fields are extracted/evaluated. I have tried changing the scope of all the knowledge objects to global through Splunk Web, as well as the corresponding metadata/local.meta files (using export = system, as well as making sure that all users have read or write permissions), but no success.
In order to narrow down the issue, I would like to be able to make every knowledge object and configuration available to all apps. Why are the permissions not working as intended?
I am using Splunk Enterprise version 7.3.6 hosted in a RHEL server.
