ES vs Non-ES search, ES does not show modified TA-tippingpoint fields

[it7272]

After modifying and renaming the TippingPoint TA, I installed it and I can now see that it is working in Non-ES Search Head and on the ES search head out side of the Enterprise Security application.

Splunk version 5.0.1
Current app: Enterprise Security
version 2.2.0, build 144974

From: https://splunk-ess.domain.com:8000/en-US/app/search/dashboard_live
Search: index="test" sourcetype="tippingpoint"
Result: Works! Tipping point fields are listed for the data.

From: https://splunk-ess.domain.com:8000/en-US/app/SplunkEnterpriseSecuritySuite/flashtimeline
Search: index="test" sourcetype="tippingpoint"
Result: Does NOT Works! Tipping point fields Don't show up.

Question 1: Does changing the name of the TA make a difference to ESS app?
Question 2: Could this be some role, with the user having access to the new TA?
Question 3: Could this be a compatibility issue?

[sbrant_splunk · Accepted solution]

In ES 2.2.0, only TAs with a name that begins with "TA-" and "Splunk_TA_" will be imported into the configuration by default and then only during setup. To add a custom TA, you must take steps to include it into the configuration and rerun the setup step of ES. This is not as bad as it sounds and is described here:

http://docs.splunk.com/Documentation/ES/latest/Install/InstallTechnologyAdd-ons

The point of this new feature is to eliminate conflicts with TAs that are incompatible with ES.

[it7272]

Thank you, that did the trick!

I opted to add the stanza to (/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf) add (companyname_TA_.*)

I went with this option because we add the company name in front of each modified TA and this method will catch all of them.

[app_imports_update://update_es]
disabled = 0
app_regex = (TA-.)|(Splunk_TA_.)|(companyname_TA_.)|(sideview_utils)|(SplunkEnterpriseSecuritySuite)|(DA-.)|(SA-.*)

1. Save changes
2. Go to Manager > Apps > Enterprise Security > Setup. Click OK.
3. Restart Splunk