How to enable all transforms and props accross apps and addons?


I am currently testing the Cisco Security Suite dashboards using data collected through the Splunk Add-on for Cisco WSA and I have noticed that some of the searches are not using any of the configuration in props.conf/transforms.conf, but when I run the same search under Search & Reporting, all the fields are extracted/evaluated. I have tried changing the scope of all the knowledge objects to global through Splunk Web, as well as the corresponding metadata/local.meta files (using export = system, as well as making sure that all users have read or write permissions), but no success.

In order to narrow down the issue, I would like to be able to make every knowledge object and configuration available to all apps. Why are the permissions not working as intended?

I am using Splunk Enterprise version 7.3.6 hosted in a RHEL server.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...