How to enable all transforms and props accross apps and addons?

Path Finder

I am currently testing the Cisco Security Suite dashboards using data collected through the Splunk Add-on for Cisco WSA and I have noticed that some of the searches are not using any of the configuration in props.conf/transforms.conf, but when I run the same search under Search & Reporting, all the fields are extracted/evaluated. I have tried changing the scope of all the knowledge objects to global through Splunk Web, as well as the corresponding metadata/local.meta files (using export = system, as well as making sure that all users have read or write permissions), but no success.

In order to narrow down the issue, I would like to be able to make every knowledge object and configuration available to all apps. Why are the permissions not working as intended?

I am using Splunk Enterprise version 7.3.6 hosted in a RHEL server.

Labels (1)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>