Splunk Enterprise Security

How come I can't see my own apps in Correlation Search App's drop-down in Enterprise Security?

Communicator

When doing a Correlation Search in ES, I want to save it in my own Apps, but they don't show in the drop-down.

I can see them if I query:
| REST /services/apps/local splunk_server=local
And, for example, I can select one of the Apps when I do an Alert.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi,

You need to define your app in app_regex in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf, see documentation https://docs.splunk.com/Documentation/ES/5.2.1/Install/ImportCustomApps

View solution in original post

SplunkTrust
SplunkTrust

Hi,

You need to define your app in app_regex in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf, see documentation https://docs.splunk.com/Documentation/ES/5.2.1/Install/ImportCustomApps

View solution in original post

Communicator

Like a glove, domo arigatou gozaimasu.

0 Karma