All Apps and Add-ons

How do you package an App with an index or Data?

Carolina
Engager

Hi,

I need your help for packaging a Splunk app while having the index or Data in Splunk App.

Is this possible?

Regards

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's a doc for that. See https://docs.splunk.com/Documentation/Splunk/7.2.1/Installation/MigrateaSplunkinstance

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of a way to include an index in an app, but you can include sample data. Just create a directory called "samples" in your app and put the data files there.

---
If this reply helps you, Karma would be appreciated.
0 Karma

sdchakraborty
Contributor

yes its possible, to ship an index with a app you need to include indexes.conf file with below sample structure,

[demo_index]
coldPath = $SPLUNK_DB\demo_index\colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB\demo_index\db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB\demo_index\thaweddb

Sid

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This doesn't ship an index itself, just the definition of an index. Also, it's against Best Practices to ship enabled index definitions.

---
If this reply helps you, Karma would be appreciated.

Carolina
Engager

ok, how could restore the data in other splunk 7.2?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What do you mean by "restore"? Are you trying to use Package App to migrate to a different server?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Carolina
Engager

I need migrate the Splunk app & the data to a diferent server

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Packaging an app is not for migration to a different server.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...