Hey @thellmann , Appreciate the info! We are already making changes to conf files via the REST API, so should be all set there. The app (actually an add-on) is pretty simple. We take input from the user (currently via setup.xml and soon to be a setup view) and save the configuration values via the REST API (using Splunk Python SDK soon to be Splunk JS SDK). We also have a modalert script that sends splunk search data or notable event data to a 3rd party app when a saved search is matched.
... View more