Dashboards & Visualizations

Divide search app into multiple apps of Alerts and Dashboards

mufthmu
Path Finder

Hi,
I am planning to create 3 separate child apps from the Search app.
Basically one app dedicated to Alerts, and the other two are for Dashboards and Indexes.
I tried to make a tar file consisting of all the Alerts from the Search app. But when I upload and install the tar (as an app) thru the UI, there is nothing there as if it's just a fresh blank app.
Does anyone have an idea?
Thanks in advance

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mufthmu,
at first, did you followed all the steps in app creation ( https://dev.splunk.com/enterprise/docs/releaseapps/packagingtoolkit )?
probably there's an error in app creation (there must be two embedded tars: the first having as output tar extension and the second tar.gz extension).
You can test if it's all ok, copying the untared app in $SPLUNK_HOME/etc/apps folder and restarting Splunk: if it runs there's an error in tar, if instead it continuea to not work there's a problem in knowledge objects.

Anyway, It isn't a good practice to use the Search App for dashboards or alerts.
At the same time It isn't a good idea to have dashboards and alerts in different apps because you have to duplicate knowledge objects (fields, eventtypes, etc...) or to share them between apps.

The best approach is to have different apps for different uses cases and if you have different objects, or grants.

When I have to do dashboards or alerts, I usually create a new app (an app is an empty container!) and I create all my knowledge objects inside the app so it's easy to move and to manage it.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...