Dashboards & Visualizations

How do you replicate reports, dashboard, lookup fields etc...?

Jarohnimo
Builder

Sorry if this question is elementary but I just stood up a new search head, and then added the existing stand alone environment to it. So now I have 1 SH and then 1 indx that has all other services ran on it.

When I login to the SH to search it works fine. I can see all the indexed data from the indexer and that's fantastic ...but on the new search head when I click on reports ,dashboards, lookups fields, tags, extractions... all those items it took forever to make are not there. Im certain I shouldn't have to manually add. There's a way to copy or clone , replicate from the existing indexer .. how do I fox this? Thank you .

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You have been treating your Indexer as a Search Head, which it is, but this is inadvisable and you are right to stop. You need to copy all of your knowledge objects from $SPLUNK_HOME/etc/apps manually. It should be fine to copy EVERYTHING except for indexes.conf if that is easiest,

View solution in original post

0 Karma

Jarohnimo
Builder

I also Have ITSI (IT Service Intelligence installed) It's also within the app directory but i notice that none of the Services and KPI's show up. Would someone from splunk chime in as to what directories need to be copied over to capture all the services, kpi's etc...

Much Thanks!

0 Karma

woodcock
Esteemed Legend

You have been treating your Indexer as a Search Head, which it is, but this is inadvisable and you are right to stop. You need to copy all of your knowledge objects from $SPLUNK_HOME/etc/apps manually. It should be fine to copy EVERYTHING except for indexes.conf if that is easiest,

0 Karma

gcusello
SplunkTrust
SplunkTrust

You have to copy your App (etc/apps/youapp) into the new search head and then restart Splunk.
Be aware that all the objects in tour app aren't private!
Then verify that the Distributed search in tour new sh is well configured.
Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...