Splunk Enterprise Security

How come I can't see my own apps in Correlation Search App's drop-down in Enterprise Security?

osakachan
Communicator

When doing a Correlation Search in ES, I want to save it in my own Apps, but they don't show in the drop-down.

I can see them if I query:
| REST /services/apps/local splunk_server=local
And, for example, I can select one of the Apps when I do an Alert.

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You need to define your app in app_regex in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf, see documentation https://docs.splunk.com/Documentation/ES/5.2.1/Install/ImportCustomApps

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You need to define your app in app_regex in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf, see documentation https://docs.splunk.com/Documentation/ES/5.2.1/Install/ImportCustomApps

osakachan
Communicator

Like a glove, domo arigatou gozaimasu.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>