Hello everyone,
I'm working with Splunk and Nagios integrated (at Zappos), and we just changed our approach to monitor an application.
We have set up almost 70 scheduled searches but we need to disable, and then erase, all of them, but we don't need to lose those. So, I'm wondering if there's any chance that Scheduled Searches, and Saved Searches, could be exported from their .conf or wherever they are stored in order to add them back to Splunk in a near (or not that near) future.
I'll appreciate any input on this.
Thank you for you time. Cheers.
Gonzalo Foligna
Level 1 Operations Support - www.edrans.com
London: +44 20 3318 1571 | Buenos Aires: +54 11 5368 5839 - Ext. 8014
All saved searches including their scheduling (if any), name, search parameters etc reside in savedsearches.conf
. Create backups of these files and you will have effectively created backups of the saved searches themselves.
NOTE that, as you may know, like pretty much any Splunk configuration file savedsearches.conf
can reside in multiple locations, so make sure you look in all the right places (for instance $SPLUNK_HOME/etc/apps/<yourApp>/local/savedsearches.conf
would be likely if the saved searches reside inside a specific app).
All saved searches including their scheduling (if any), name, search parameters etc reside in savedsearches.conf
. Create backups of these files and you will have effectively created backups of the saved searches themselves.
NOTE that, as you may know, like pretty much any Splunk configuration file savedsearches.conf
can reside in multiple locations, so make sure you look in all the right places (for instance $SPLUNK_HOME/etc/apps/<yourApp>/local/savedsearches.conf
would be likely if the saved searches reside inside a specific app).
It works perfectly!
Thank you!
Thanks! I'll check that and get back to you.