If you plan on publishing the app or distributing it you need to either package the props/transforms that are needed to make these fields or include a requirement that they install the other TAs that include the extractions. The only way to make the extractions work within your XXXX Splunk App on your search head is to find the extractions and change the permissions to "global" instead of "local". If the extraction is "local" to the "Search and Reporting App" then you won't be able to see it in your XXXX Splunk App. Take a look at the image below, these two extractions are saved in the "search" app, but are also global so other apps can use them. Hope this helps, GTRI Splunk Team! ... View more

Hello. Does the search head with ES installed on it have access to the Internet? Are other threat lists downloading? ... View more

Hi fairje, On Linux you can fork a non-child process to restart Splunk, but since you are using Windows take a look below. When Splunk starts up it will enable all scripted inputs which will cause them to run. If your scripted input restarts Splunk you will get stuck in a loop. One solution is to use an if-statement to trigger the restart. Let's say your scripted input changes the hostname to "mynewhostname", you can do something like this: if hostname != mynewhostname: change it restart splunk This would only restart Splunk once and eliminate the restart loop, assuming your hostname doesn't keep changing. If you are using a deployment server you can delete the entire app directory which would cause the deployment server to download the app again and restart Splunk (assuming you have the app triggered to do so). Take a look at this app for an exact example: https://splunkbase.splunk.com/app/2722/ GTRI Splunk Team! ... View more