Tripwire Enterprise App for Splunk Enterprise: Why are tags associated with event types not being applied?

[responsys_cm]

I'm using the Tripwire Enterprise App for Splunk Enterprise.

I have an event type called "te_fim". Its search string is: index=te sourcetype=te_fim_csv. It applies three tags: attack, change, endpoint.

If I run a search on eventtype=te_fim, I see the matching events, but the tag field never shows up.

I do see that some of the event types/tags that ship with the app are working. The only thing different about them is that their owner is "admin" instead of "No owner".

Any ideas why this isn't working? Or how to change the owner of an event type?

[gjanders]

Perhaps you need to check the permissions/exports on the application ?

You can change the owner of an event type, I believe this would work but I have not tested it:
First you need to find the relevant eventtype, I would do this by looking at:
https://localhost:8089/servicesNS/nobody/Splunk_TA_aws/saved/eventtypes

Or the relevant application.

curl -k -u admin:changeme -d 'owner=foo' -d 'sharing=app' https://localhost:8089/servicesNS/admin/Splunk_TA_aws/saved/eventtypes/event1/acl

You might want to check the event types are exported in the metadata:

### EVENT TYPES
[eventtypes]
export = system

I would expect something like that in the default.meta file of the metadata directory of the application if you expect the event types to be visible in all applications...