All Apps and Add-ons

How do you package an App with an index or Data?

Carolina
Engager

Hi,

I need your help for packaging a Splunk app while having the index or Data in Splunk App.

Is this possible?

Regards

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's a doc for that. See https://docs.splunk.com/Documentation/Splunk/7.2.1/Installation/MigrateaSplunkinstance

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of a way to include an index in an app, but you can include sample data. Just create a directory called "samples" in your app and put the data files there.

---
If this reply helps you, Karma would be appreciated.
0 Karma

sdchakraborty
Contributor

yes its possible, to ship an index with a app you need to include indexes.conf file with below sample structure,

[demo_index]
coldPath = $SPLUNK_DB\demo_index\colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB\demo_index\db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB\demo_index\thaweddb

Sid

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This doesn't ship an index itself, just the definition of an index. Also, it's against Best Practices to ship enabled index definitions.

---
If this reply helps you, Karma would be appreciated.

Carolina
Engager

ok, how could restore the data in other splunk 7.2?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What do you mean by "restore"? Are you trying to use Package App to migrate to a different server?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Carolina
Engager

I need migrate the Splunk app & the data to a diferent server

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Packaging an app is not for migration to a different server.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...