Reporting

Migrating Saved Search from 3.x to 4.x

Simon
Contributor

Hi folks

Is there a way to manually migrate saved searches from splunk 3.x to 4.x? The problem is that I didn't upgrade my splunk instance but rather built a new splunk instance beside and let my forwarders send the data to both instances so I miss now my saved searches on the new splunk 4.x box.

Thanks for hints, Simon

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

In general, you should be able to just copy the 3.x saved search stanza from savedsearches.conf to a savedsearches.conf file in 4.x. Note however that in 4.x, savedsearches.conf can't sit in etc/system, and must be in an app and run in an app context. (Migration moves them to the search app.)

There are a couple of search syntax changes and a couple of search commands that may have changed, but the vast majority should work without change.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

In general, you should be able to just copy the 3.x saved search stanza from savedsearches.conf to a savedsearches.conf file in 4.x. Note however that in 4.x, savedsearches.conf can't sit in etc/system, and must be in an app and run in an app context. (Migration moves them to the search app.)

There are a couple of search syntax changes and a couple of search commands that may have changed, but the vast majority should work without change.

Simon
Contributor

Thanks, that's good to hear!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...