How come I can't see my own apps in Correlation Search App's drop-down in Enterprise Security?

[osakachan]

When doing a Correlation Search in ES, I want to save it in my own Apps, but they don't show in the drop-down.

I can see them if I query:
| REST /services/apps/local splunk_server=local
And, for example, I can select one of the Apps when I do an Alert.

[harsmarvania57 · Accepted solution]

Hi,

You need to define your app in app_regex in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf, see documentation https://docs.splunk.com/Documentation/ES/5.2.1/Install/ImportCustomApps

[osakachan]

Like a glove, domo arigatou gozaimasu.