Splunk Enterprise Security

Splunk Enterprise Security: Lookups and other props/transforms

arlombar
Explorer

Hello,

I've run into an issue lately where I want both my search heads and Enterprise Security to show the same field extractions and use the same lookups to sync the data across the components/data sources.

However, I'm finding that unless I add a lookup/props.conf/transforms.conf to one of Enterprise Security's stock apps (ex. SplunkEnterpriseSecuritySuite or any of the ES SA's), my extracted fields and lookups will only show in an Enterprise Security search and not on any other app searches.

For administrative purposes, I'd like to keep these files specific to the app, and then just control the permissions to either Global or App based. In this case, I want them to be global. Has anyone else run into this issue or am I doing something wrong here? If I add a props/transform/lookup field outside the base ES apps, my ES searches are missing these fields/enrichment. This is not the same behavior as any other app I've worked with or any of the base Splunk apps.

0 Karma

cgardiner
Explorer

Also remember...
The behavior has changed with ES 6.0. ES no longer explicitly imports apps using the naming convention. It has reverted to requiring configuration to be exported to system in order to see the configuration.. So which answer is correct depends on which version of ES you are working with.

0 Karma

lakshman239
Influencer

Also, by default, ES imports apps that start with TA-, SA-, Splunk_* . So, if your app is following a diff name, you would need to add your app/add-on to the import, as per https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps

This will ensure your app is visible within the context of ES. You can then update local.meta with required permissions for any knowledge objects to control the visibility.

0 Karma

vnakra_splunk
Splunk Employee
Splunk Employee

Knowledge objects have permissions. Set the permissions on your extractions and lookups by by packaging them inside an app of your own (useful if you plan to rev these often/distribute them), then adding the following to a metadata/default.meta file inside the app.


[]
export=system

https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Defaultmetaconf

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...