Reporting

How to export my custom TA to share with other Splunk instances?

DEAD_BEEF
Builder

I have a custom TA installed and was wondering what is the method to copy the entire thing and share it? I looked on the deployment server and it's listed there (but not in Apps) so I'm not sure how to go about exporting it. Do I just copy the TA's directory from the DS itself?

0 Karma
1 Solution

dflodstrom
Builder

You can just tar up the App/TA directory and install that (a .tar, .tar.gz, or .tgz should work just fine) or have a look at this answer for the Splunk command to create a .spl

splunk package app <appName>

https://answers.splunk.com/answers/109787/how-to-export-a-splunk-app-to-spl.html

View solution in original post

0 Karma

dflodstrom
Builder

You can just tar up the App/TA directory and install that (a .tar, .tar.gz, or .tgz should work just fine) or have a look at this answer for the Splunk command to create a .spl

splunk package app <appName>

https://answers.splunk.com/answers/109787/how-to-export-a-splunk-app-to-spl.html

0 Karma

DEAD_BEEF
Builder

Thank you, I thought it might be this straightforward but I wasn't sure and couldn't find anything stating such.

kthammireddy
New Member
  1. You can copy the TA's to $SPLUNK_HOME/etc/deployment-apps on your Deployment Server.
  2. Use forwarder management to deploy TA's to other splunk instances.
  3. This might be usefull link http://docs.splunk.com/Documentation/Splunk/7.1.0/Updating/Aboutdeploymentserver
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...