Splunk Enterprise Security

Commands not usable from Enterprise Security?

Communicator

I have an app installed from Splunkbase, which has custom search command defined in it. I've set the commands to be globally available, and it works fine. I can invoke the commands from any of the apps I have in Splunk, except Enterprise Security.

Is there a way to configure ES to be able to invoke commands from other app's context?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Check the default.meta and local.meta in the ess app/metadata folder to see if there is an IMPORT key.

If so, add your app to that key

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi szabados, ES uses a modular input to control what is allowed in the app context. This input is called app_imports_update

The input has a few config directives, app_regex in particular controls what comes in. You'll have to update this regex to include the pattern that matches the name of the app you want in.

More info available here:
http://docs.splunk.com/Documentation/ES/4.6.0/Install/InstallTechnologyAdd-ons

Please let me know if this answers your question! 😄

Splunk Employee
Splunk Employee

In ES you can go to "Configure>General>App Imports Update". From there just change the settings for update_es:

updatees (SA-.*)|(SplunkSA.) (appsbrowser)|(search)|([ST]A-.)|(Splunk[ST]A.)|(DA-ESS-.)|(SplunkDA-ESS.*)|(slackalerts)

In my case I just added |(slackalerts) to the regex which will import the app slackalerts from Splunkbase.

0 Karma

SplunkTrust
SplunkTrust

Check the default.meta and local.meta in the ess app/metadata folder to see if there is an IMPORT key.

If so, add your app to that key

View solution in original post

0 Karma

Communicator

Thanks, this has been a headache for me for a while 🙂

0 Karma

SplunkTrust
SplunkTrust

Yeah, ES is a special kind of app. You'll need to check that link jkat54 mentioned.

0 Karma

SplunkTrust
SplunkTrust

As per muebel's comment below, ES may revert this change when it runs it's configuration checkers. Sounds like you need to do what he is suggesting by editing the modular input called appimportsupdate.

http://docs.splunk.com/Documentation/ES/4.6.0/Install/InstallTechnologyAdd-ons#Import_custom_apps_an...

0 Karma