Reporting

How to enable all transforms and props accross apps and addons?

ricotries
Path Finder

I am currently testing the Cisco Security Suite dashboards using data collected through the Splunk Add-on for Cisco WSA and I have noticed that some of the searches are not using any of the configuration in props.conf/transforms.conf, but when I run the same search under Search & Reporting, all the fields are extracted/evaluated. I have tried changing the scope of all the knowledge objects to global through Splunk Web, as well as the corresponding metadata/local.meta files (using export = system, as well as making sure that all users have read or write permissions), but no success.

In order to narrow down the issue, I would like to be able to make every knowledge object and configuration available to all apps. Why are the permissions not working as intended?

I am using Splunk Enterprise version 7.3.6 hosted in a RHEL server.

Labels (1)
0 Karma