Dashboards & Visualizations

How migrate dashboards of the Search App on a standalone dev Search Head to a Search Head Cluster?

ishaanshekhar
Communicator

Dear SPLUNK Community,

I have one development Search Head and a Search Head Cluster in my cluster. I am using the default search app to create dashboards on a dev SH.

I create dashboards with the admin role and share it with all users within the App. I also use custom css, js, and images in the dashboards.

Could you please help me understand the best way to migrate the dashboards I develop in dev SH to SHC? (I do have a Deployer as well)

I read somewhere that since Search is a default app, I should not be pushing it to a SHC using the Deployer as it may override the app version.

Thank you so much!
Ishaan

1 Solution

Steve_G_
Splunk Employee
Splunk Employee

Steve_G_
Splunk Employee
Splunk Employee

See the guidance offered here:

http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Migratefromstandalonesearchheads#Do_not...

Then follow step #2 in the next section and adapt the subsequent steps in that procedure to fit your need: http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Migratefromstandalonesearchheads#Migrat...

chanfoli
Builder

I have a similar problem migrating all of our dashboards which were created in search on pooled 6.0 search heads to clustered 6.3.0 search heads. I have attempted to ensure the steps described for getting objects out of the search app, putting them into a "search migration" app and pushing them to the search head cluster members as described but my dashboards are not visible to the original owner or admin user in the search context and I am not seeing how to get them to show up. I found references to the views in /$SPLUNK_HOME/etc/apps/search/metadata/local.meta so I also attempted to get these into the local.meta file for the "migration app", this apparently gets it pushed out and merged into the default.meta file but it does not fix the missing dashboards.

0 Karma

maciep
Champion

Were you planning to push those changes to the search app in the shc or to another app? or multiple different apps maybe?

In general, I would say don't use the search app. With that said, whatever other app you choose to push those changes to in the shc, I would have the same exact app on the dev box. And then once the changes look good, copy it over to the deployer and push out to the cluster.

0 Karma

ishaanshekhar
Communicator

I do not have a separate app currently. I am using the Search app itself on the dev box. I understand it is not the ideal way, but would like to know how should I migrate my dashboards, js and css files in the shc from the dev box.

0 Karma

maciep
Champion

I would recommend against that. It should be easy enough to create a new app and copy the files over there. That said...

If not, then i would suggest you don't manage those files from the deployer. Instead just copy the files directly down to the search app on the members (may have to do a rolling restart before they're recognized, not sure). And then manually create the dashboards in Splunk Web on one of the cluster members (just copy/paste dashboard source to a new dashboard in the search app). The dashboards themselves will get replicated to the other members.

Technically, you probably could copy the search app from a member to the deployer. Place your files and dashboards there. Then push the entire search app back down to the members. But that just seems like a really bad idea and would likely cause you quite a headache later on.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can now create a separate app and copy all the required objects into new app and push that app to the SH cluster, unless you want to have your dashboards available in the Search App only (if you've a choice, have it under specific app, rather than default search).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...