Splunk Enterprise Security

Commands not usable from Enterprise Security?

szabados
Communicator

I have an app installed from Splunkbase, which has custom search command defined in it. I've set the commands to be globally available, and it works fine. I can invoke the commands from any of the apps I have in Splunk, except Enterprise Security.

Is there a way to configure ES to be able to invoke commands from other app's context?

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Check the default.meta and local.meta in the ess app/metadata folder to see if there is an IMPORT key.

If so, add your app to that key

View solution in original post

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi szabados, ES uses a modular input to control what is allowed in the app context. This input is called app_imports_update

The input has a few config directives, app_regex in particular controls what comes in. You'll have to update this regex to include the pattern that matches the name of the app you want in.

More info available here:
http://docs.splunk.com/Documentation/ES/4.6.0/Install/InstallTechnologyAdd-ons

Please let me know if this answers your question! 😄

kchamplin_splun
Splunk Employee
Splunk Employee

In ES you can go to "Configure>General>App Imports Update". From there just change the settings for update_es:

update_es (SA-.)|(Splunk_SA_.) (appsbrowser)|(search)|([ST]A-.)|(Splunk_[ST]A_.)|(DA-ESS-.)|(Splunk_DA-ESS_.)|(slack_alerts)

In my case I just added |(slack_alerts) to the regex which will import the app slack_alerts from Splunkbase.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Check the default.meta and local.meta in the ess app/metadata folder to see if there is an IMPORT key.

If so, add your app to that key

0 Karma

szabados
Communicator

Thanks, this has been a headache for me for a while 🙂

0 Karma

muebel
SplunkTrust
SplunkTrust

Yeah, ES is a special kind of app. You'll need to check that link jkat54 mentioned.

0 Karma

jkat54
SplunkTrust
SplunkTrust

As per muebel's comment below, ES may revert this change when it runs it's configuration checkers. Sounds like you need to do what he is suggesting by editing the modular input called app_imports_update.

http://docs.splunk.com/Documentation/ES/4.6.0/Install/InstallTechnologyAdd-ons#Import_custom_apps_an...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...