When doing a Correlation Search in ES, I want to save it in my own Apps, but they don't show in the drop-down.
I can see them if I query:
| REST /services/apps/local splunk_server=local
And, for example, I can select one of the Apps when I do an Alert.
You need to define your app in app_regex in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf, see documentation https://docs.splunk.com/Documentation/ES/5.2.1/Install/ImportCustomApps
View solution in original post
Like a glove, domo arigatou gozaimasu.