SA-cim_vladiator not exporting configurations globally to system

[kvirchenko]

Greetings!
I continuously receiving this warning in Messages.

"Learn more" recommends to share all knowledge objects globally, but it's not right and safe.

Is there any ability to remove or dismiss this message from notification? 

Health Check: One or more apps ("SA-cim_vladiator") that had previously been imported are not exporting configurations globally to system. Configuration objects not exported to system will be unavailable in Enterprise Security.

[livehybrid]

Hi @kvirchenko 

What makes you think that its not right to share to knowledge objects globally from the app? 

I think in this case you probably need to go to https://yoursplunkinstance/en-US/manager/search/apps/local and find the SA-cim_vladiator app, click on permission and change the 'display for' to 'All Apps". 

I think this will resolve the warning for you.

More information about the warning can also be found at https://splunk.my.site.com/customer/s/article/Splunk-Enterprise-Security-ERROR-One-or-more-Apps-List...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[sohailmohammed]

Hi, 

I had same error, I made it global to get rid of it.

How to fix it (Choose one method):

1. Change Permissions via GUI (Recommended):
   • Go to Settings > Apps > Manage Apps.
   • Find SA-cim_vladiator and click Permissions.
   • Set "Display for" to All Apps or Global, then save.
2. Edit local.meta File (Advanced):
   • Navigate to the app's directory: $SPLUNK_HOME/etc/apps/SA-cim_vladiator/local/.
   • Create or edit local.meta (or edit existing metadata/*.meta files).
   • Add export=system under the relevant stanzas (e.g., [tags], [eventtypes]) to make them system-wide.
   • Restart Splunk or reload configurations after changes