Splunk Enterprise Security: Lookups and other props/transforms

[arlombar]

Hello,

I've run into an issue lately where I want both my search heads and Enterprise Security to show the same field extractions and use the same lookups to sync the data across the components/data sources.

However, I'm finding that unless I add a lookup/props.conf/transforms.conf to one of Enterprise Security's stock apps (ex. SplunkEnterpriseSecuritySuite or any of the ES SA's), my extracted fields and lookups will only show in an Enterprise Security search and not on any other app searches.

For administrative purposes, I'd like to keep these files specific to the app, and then just control the permissions to either Global or App based. In this case, I want them to be global. Has anyone else run into this issue or am I doing something wrong here? If I add a props/transform/lookup field outside the base ES apps, my ES searches are missing these fields/enrichment. This is not the same behavior as any other app I've worked with or any of the base Splunk apps.

[cgardiner]

Also remember...
The behavior has changed with ES 6.0. ES no longer explicitly imports apps using the naming convention. It has reverted to requiring configuration to be exported to system in order to see the configuration.. So which answer is correct depends on which version of ES you are working with.

[lakshman239]

Also, by default, ES imports apps that start with TA-, SA-, Splunk_* . So, if your app is following a diff name, you would need to add your app/add-on to the import, as per https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps

This will ensure your app is visible within the context of ES. You can then update local.meta with required permissions for any knowledge objects to control the visibility.

[vnakra_splunk]

Knowledge objects have permissions. Set the permissions on your extractions and lookups by by packaging them inside an app of your own (useful if you plan to rev these often/distribute them), then adding the following to a metadata/default.meta file inside the app.


[]
export=system


https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Defaultmetaconf