Splunk Enterprise Security

Splunk Enterprise Security: Lookups and other props/transforms



I've run into an issue lately where I want both my search heads and Enterprise Security to show the same field extractions and use the same lookups to sync the data across the components/data sources.

However, I'm finding that unless I add a lookup/props.conf/transforms.conf to one of Enterprise Security's stock apps (ex. SplunkEnterpriseSecuritySuite or any of the ES SA's), my extracted fields and lookups will only show in an Enterprise Security search and not on any other app searches.

For administrative purposes, I'd like to keep these files specific to the app, and then just control the permissions to either Global or App based. In this case, I want them to be global. Has anyone else run into this issue or am I doing something wrong here? If I add a props/transform/lookup field outside the base ES apps, my ES searches are missing these fields/enrichment. This is not the same behavior as any other app I've worked with or any of the base Splunk apps.

0 Karma


Also remember...
The behavior has changed with ES 6.0. ES no longer explicitly imports apps using the naming convention. It has reverted to requiring configuration to be exported to system in order to see the configuration.. So which answer is correct depends on which version of ES you are working with.

0 Karma


Also, by default, ES imports apps that start with TA-, SA-, Splunk_* . So, if your app is following a diff name, you would need to add your app/add-on to the import, as per https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps

This will ensure your app is visible within the context of ES. You can then update local.meta with required permissions for any knowledge objects to control the visibility.

0 Karma

Splunk Employee
Splunk Employee

Knowledge objects have permissions. Set the permissions on your extractions and lookups by by packaging them inside an app of your own (useful if you plan to rev these often/distribute them), then adding the following to a metadata/default.meta file inside the app.



0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...