Splunk Enterprise Security

Commands not usable from Enterprise Security?

szabados
Communicator

I have an app installed from Splunkbase, which has custom search command defined in it. I've set the commands to be globally available, and it works fine. I can invoke the commands from any of the apps I have in Splunk, except Enterprise Security.

Is there a way to configure ES to be able to invoke commands from other app's context?

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Check the default.meta and local.meta in the ess app/metadata folder to see if there is an IMPORT key.

If so, add your app to that key

View solution in original post

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi szabados, ES uses a modular input to control what is allowed in the app context. This input is called app_imports_update

The input has a few config directives, app_regex in particular controls what comes in. You'll have to update this regex to include the pattern that matches the name of the app you want in.

More info available here:
http://docs.splunk.com/Documentation/ES/4.6.0/Install/InstallTechnologyAdd-ons

Please let me know if this answers your question! 😄

kchamplin_splun
Splunk Employee
Splunk Employee

In ES you can go to "Configure>General>App Imports Update". From there just change the settings for update_es:

update_es (SA-.)|(Splunk_SA_.) (appsbrowser)|(search)|([ST]A-.)|(Splunk_[ST]A_.)|(DA-ESS-.)|(Splunk_DA-ESS_.)|(slack_alerts)

In my case I just added |(slack_alerts) to the regex which will import the app slack_alerts from Splunkbase.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Check the default.meta and local.meta in the ess app/metadata folder to see if there is an IMPORT key.

If so, add your app to that key

View solution in original post

0 Karma

szabados
Communicator

Thanks, this has been a headache for me for a while 🙂

0 Karma

muebel
SplunkTrust
SplunkTrust

Yeah, ES is a special kind of app. You'll need to check that link jkat54 mentioned.

0 Karma

jkat54
SplunkTrust
SplunkTrust

As per muebel's comment below, ES may revert this change when it runs it's configuration checkers. Sounds like you need to do what he is suggesting by editing the modular input called app_imports_update.

http://docs.splunk.com/Documentation/ES/4.6.0/Install/InstallTechnologyAdd-ons#Import_custom_apps_an...

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!