I'm attempting to create a new correlation search in Splunk Enterprise Security (4.1). I've created a blank app to house all the custom searches, but when I pick the app from the "Application Context" drop-down menu, the message "Unmanaged App has been selected" shows up beside my selection.
Anyone know what a "managed app" means in the context of ES?
I made sure to use an app name that gets "imported" into the ES eco system (example: SA-CLIENT-ES-Searches) but that doesn't seem to be what "managed" means.
↧