Commands not usable from Enterprise Security?

[szabados]

I have an app installed from Splunkbase, which has custom search command defined in it. I've set the commands to be globally available, and it works fine. I can invoke the commands from any of the apps I have in Splunk, except Enterprise Security.

Is there a way to configure ES to be able to invoke commands from other app's context?

[muebel]

Hi szabados, ES uses a modular input to control what is allowed in the app context. This input is called app_imports_update

The input has a few config directives, app_regex in particular controls what comes in. You'll have to update this regex to include the pattern that matches the name of the app you want in.

More info available here:
http://docs.splunk.com/Documentation/ES/4.6.0/Install/InstallTechnologyAdd-ons

Please let me know if this answers your question! 😄

[kchamplin_splun]

In ES you can go to "Configure>General>App Imports Update". From there just change the settings for update_es:

update_es (SA-.)|(Splunk_SA_.) (appsbrowser)|(search)|([ST]A-.)|(Splunk_[ST]A_.)|(DA-ESS-.)|(Splunk_DA-ESS_.)|(slack_alerts)

In my case I just added |(slack_alerts) to the regex which will import the app slack_alerts from Splunkbase.

[jkat54 · Accepted solution]

Check the default.meta and local.meta in the ess app/metadata folder to see if there is an IMPORT key.

If so, add your app to that key

[szabados]

Thanks, this has been a headache for me for a while 🙂

[muebel]

Yeah, ES is a special kind of app. You'll need to check that link jkat54 mentioned.

[jkat54]

As per muebel's comment below, ES may revert this change when it runs it's configuration checkers. Sounds like you need to do what he is suggesting by editing the modular input called app_imports_update.

http://docs.splunk.com/Documentation/ES/4.6.0/Install/InstallTechnologyAdd-ons#Import_custom_apps_an...