All Apps and Add-ons

How to move field extractions and dashboards from a Splunk Installation to another one?

fvasquezchacon
Path Finder

Hi!

I have some field extractions and dashboards on my current Splunk and I would like to move them to another laptop with Splunk as well. Is there a quick and easy form to do this duty? The new installation has the same indexed data.

Thanks in advance!

0 Karma
1 Solution

lguinn2
Legend

If you put the field extractions, dashboards (and any other knowledge objects that you want) into an app, you can then copy the app directory from one Splunk instance to another very easily.

First, create an app. I am calling it "myApp" in this example. Then clone or move each knowledge object to the new app. You might want to think about the permissions of the knowledge objects at this point, and set them as needed.

When finished, you will find your app under $SPLUNK_HOME/etc/myApp. You can zip it up or tar it or whatever. Now you can take that copy and put it on any other Splunk instance. Just be sure to put it in the same place: $SPLUNK_HOME/etc/myApp and then restart Splunk so it will pick up the new app.

View solution in original post

0 Karma

fvasquezchacon
Path Finder

Thank you so much. It works perfect.

In relation with this topic, you know if there is something equivalent for the timestamp and break event regex when indexing? I would like to save those too.

0 Karma

lguinn2
Legend

If you put the field extractions, dashboards (and any other knowledge objects that you want) into an app, you can then copy the app directory from one Splunk instance to another very easily.

First, create an app. I am calling it "myApp" in this example. Then clone or move each knowledge object to the new app. You might want to think about the permissions of the knowledge objects at this point, and set them as needed.

When finished, you will find your app under $SPLUNK_HOME/etc/myApp. You can zip it up or tar it or whatever. Now you can take that copy and put it on any other Splunk instance. Just be sure to put it in the same place: $SPLUNK_HOME/etc/myApp and then restart Splunk so it will pick up the new app.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...