Not always safe no. You should be sure you want the KOs within an app to be exported system wide before you change this setting. The doco for default.meta isn't particularly useful on this * By default, objects are only visible within the app in which they were created.
To make an object available to all apps, set the object's 'export' setting to
"system".
* export = system Essentially if you set the default to an app to system then the when you are in another app you will still see content from this app. That can be good but it can also be bad, if the app you set to export = system has overly complex props for field extraction etc they may start to make info harder to read in another app. When you search in Splunk you are doing so through several lenses or overlays, Your user, the seacrh head itself and then the app you are in and other apps that export to system. ES is a little different on that final bit in that it only "imports" other apps if they match a whitelist/pattern. In the case of Cim validator there isn't much to worry about but it is always worth being sure you want to actually export to system before doing so.
... View more