How do I share objects such as a custom searches (residing in another app) so that I can access them within Enterprise Security?

[otan1010]

How do I share objects such as a custom searches (residing in another app) so that I can access them within Enterprise Security?

[mdessus_splunk · Accepted solution]

First, make sure they are shared as global object.
Second, ES only import objects from apps starting with TA_ Splunk_TA ... See here for more details: https://answers.splunk.com/answers/252035/how-to-make-url-toolbox-available-from-the-splunk.html

[otan1010]

Works, thank you 🙂