topic How to export a saved search for direct deployment? in Deployment Architecture

How to export a saved search for direct deployment?

mdstemm — Tue, 21 Feb 2023 18:32:14 GMT

My team is moving from working directly in splunk to a Git based deploy where we modify the app files directly. Previously we would create and save a search directly in the Splunk web UI but now add to the savedsearches.conf.

Is there a method for creating a saved search in the web app and extracting the sintax for savedsearachs.conf or another tool for helping this process?

I've read the documentation for savedsearches.conf and much of the variables are niche in their use. Thanks for the help!
-Mitch

Re: Exporting a saved search for direct deployment

richgalloway — Tue, 21 Feb 2023 17:55:25 GMT

Create the search on your Dev instance (or your workstation) then copy the stanza from savedsearches.conf to git. When you've done that a few times, you'll have a feel for what to include in scratch-built stanzas.

Re: Exporting a saved search for direct deployment

mdstemm — Tue, 21 Feb 2023 19:39:08 GMT

We currently don't have a Dev deployment and our deployment is one way, any changes made in the web app are overwritten when synced with git on a set schedule. A local splunk might work with an extra step; create the search in web app, paste to local, add alert/report conditions and scheduling, then copy to git.

I appreciate the help and might look into getting the team a dev app that we have direct access to. But getting legit logs in for testing is unlikely.