I have an app installed from Splunkbase, which has custom search command defined in it. I've set the commands to be globally available, and it works fine. I can invoke the commands from any of the apps I have in Splunk, except Enterprise Security.
Is there a way to configure ES to be able to invoke commands from other app's context?
Hi szabados, ES uses a modular input to control what is allowed in the app context. This input is called
The input has a few config directives,
app_regex in particular controls what comes in. You'll have to update this regex to include the pattern that matches the name of the app you want in.
More info available here:
Please let me know if this answers your question! 😄
In ES you can go to "Configure>General>App Imports Update". From there just change the settings for update_es:
updatees (SA-.*)|(SplunkSA.) (appsbrowser)|(search)|([ST]A-.)|(Splunk[ST]A.)|(DA-ESS-.)|(SplunkDA-ESS.*)|(slackalerts)
In my case I just added |(slackalerts) to the regex which will import the app slackalerts from Splunkbase.
As per muebel's comment below, ES may revert this change when it runs it's configuration checkers. Sounds like you need to do what he is suggesting by editing the modular input called appimportsupdate.