How to create app that creates Alerts and Dashboards

[mufthmu]

Hi,
I'm doing alerts & dashboards migration from one splunk server to another. In the past, I had to copy each dashboards and alerts manually and it took a long time to do since we had hundreds of them.
so I was tasked to create 3 separate Splunk apps, each will migrate one of the following (separately):
1. indexes
2. alerts
3. dashboards

Does anyone have a good approach on how to do this properly?
I wonder if a script will work and regarded as a Splunk app.
Thanks!

[woodcock]

This is all way easier from the CLI. You can exploit btool to do something like this:

${SPLUNK_HOME}/bin/splunk btool savedesarches list --debug | grep to filter stuff like "etc/system/default" and "etc/system/local" > /tmp/savedsearches.conf

Now that they are all in a single file, create an appropriate app structure and properly segregate/aggregate them and then TRAIN YOUR USERS so that this will never happen again.

[richgalloway]

I think we need more information.

Is this migration on-prem to on-prem or on-prem to cloud?
Are you moving the entire Splunk instance or just some apps?
Do you have CLI access?
If you're migrating alerts & dashboards, why do you have a task to migrate indexes?

[mufthmu]

Hi @richgalloway , thanks for the response.
This is migration from on prem to the cloud.
I'm only moving the alerts and dashboards inside the apps.
I do have CLI access and I can access both nodes.
My priority is now alerts and dashboards, as far as indexes, Im not quite sure why.

[richgalloway]

Since you have CLI access on both ends, you can just copy files. Look for $SPLUNK_HOME/etc/apps/*/local/* on the old system and copy them to the same locations on the new system. Any directory that doesn't exist on the new system is an app you probably need to install. Adjust file paths in the files as necessary.