You should always put app-specific inputs, props, etc in their own app instead of just adding it to the search app
But for show-and-tell, plopping them in search is fine
February 14, 2020 at 05:42PM
via reddit https://www.reddit.com/r/Splunk/comments/etgv3d/how_to_set_up_splunk_hec_the_right_way/fhmzzi6?utm_source=ifttt