4879AB54-416D-4E42-A56F-A17A3EA873FE.png   A609CF7E-727E-4DBB-8BD1-EADD10E7A3D8.png A8ACDBB0-3197-4B4A-A98F-24291FFC4127.png   4C409153-5871-40E1-ADB6-20741C9B98C4.png    Hi Team, I have been trying to create a custom app with some config files and created it manually with the directory structures. But once submitted, I came across the below failures as mentioned by splunk. 6C2EE980-7DE9-49E4-8D34-8E92F533F4B2.png   splunk. 6C2EE980-7DE9-49E4-8D34-8E92F533F4B2.png please help me how I can solve the issues and also let me know if there are any other ways to package the app if I have some config items ... View more

So I have been working on migrating usecases from one splunk ES to splunk cloud for a client. They had around 760+ correlation searches created for similar usecases and field extraction. So I created a lookup and used lookup definition to create the correlation search. They are pointing out that this might affect the notable creation when there is a knowledge bundle fail. Also they highlighted it will lead to skipped searches. I have built similar cases for other environments with more huge lookup and search over huge data. My present lookup have 764 entries and the correlation search runs for every 15min cron looking back on the 1hour data.   so I would like the help of the experts, to answer    1. if consolidating 760 separate searches are efficient or 1search with the lookup is efficient and how 2. In case of knowledge bundle fail will it be affected and miss alerting? 3. Will it cause skipped searches if the schedule goes over? p.s. - However my search should re trigger and anyhow is checking over last 1hour data every 15min please help on this matter ... View more