There is a pulldown in the SearchBar to the right of the "Enter search here..." box that has the names of applications installed in Splunk. Not all applications show up, but the criteria does not seem to be whether or not I have access (some apps that I can use, such as S.o.S, do not appear).
What controls which apps show up on that pulldown?
I am not sure about the UI you are describing (what version of Splunk Enterprise are you running?). But the visibility of apps is controlled through the Visible property in the app settings. In the top left corner of Splunk Web, next to the Splunk logo, click Apps > Manage Apps. If you have permission to edit the app properties, you can set it to visible or not.
I believe if your permission are set to admin only within the ../metadata/default.meta where the following is set
[]
access = read : [ admin ], write : [ ]
Only admins will see the app in the drop down.
Won't that also mean that only admins can run the app?
We're on 6.1. The visible flag affects what shows up on the home page, but I have apps with visible turned on that are not on that pulldown.
Screen shot at https://docs.google.com/a/whirlpool.com/presentation/d/12Jb6FGff6zdHkTHB9RWLAr9aSuVm8GnmmMBmdOX9ma8/...
or
https://drive.google.com/file/d/0B2TxSpe82y7Obmp4b1RycFhBb2c/view?usp=sharing