Where does splunk put things you develop?

[cmeo]

I find myself continually mystified by Splunk's strategy for placing things like event types, saved searches etc. How can this behaviour be controlled, and how can I tell splunk e.g. I do not want my saved search to be saved in etc/users/username/[app]/local but in the app savedsearches.conf itself?

Is there any enhancement in prospect to be able to control where a new is object is placed when you create it? Or at least display the current context so you can find the darn thing easily later?

[gkanapathy]

Well, in general a new object will always be placed in the user directory (private) until it is promoted to be App or Global shared. It would be worthwhile ER to ask for some mode or role or setting to allow some users (with appropriate permissions) to automatically have objects made App-shared.

As for which app, well, it just happens which one you came from, and it is subtle, but when you create an object in the GUI, it does present a drop-down at the top to change the app, though the default is the one you were last in. I do realize this is fail behavior, but I'm not entirely sure what would work better.