Splunk Dev

Where does splunk put things you develop?

cmeo
Contributor

I find myself continually mystified by Splunk's strategy for placing things like event types, saved searches etc. How can this behaviour be controlled, and how can I tell splunk e.g. I do not want my saved search to be saved in etc/users/username/[app]/local but in the app savedsearches.conf itself?

Is there any enhancement in prospect to be able to control where a new is object is placed when you create it? Or at least display the current context so you can find the darn thing easily later?

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Well, in general a new object will always be placed in the user directory (private) until it is promoted to be App or Global shared. It would be worthwhile ER to ask for some mode or role or setting to allow some users (with appropriate permissions) to automatically have objects made App-shared.

As for which app, well, it just happens which one you came from, and it is subtle, but when you create an object in the GUI, it does present a drop-down at the top to change the app, though the default is the one you were last in. I do realize this is fail behavior, but I'm not entirely sure what would work better.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...