topic Re: Splunk application renaming without losing existing user data in Getting Data In

Splunk application renaming without losing existing user data

Moogsoft — Mon, 16 Dec 2024 08:51:20 GMT

I have an application on Splunkbase and want to rename it along with the commands and custom action.

I have updated the app name by renaming the folder and updating the app ID. I've also updated the commands and custom action with the new name.

While testing it on my local Splunk instance I observed that the existing application isn't getting replaced with a new one as the folder name and app name/ID is different compared to the older version.

I believe that is fine as I can ask users to remove it from their instances, but I want the saved searches as well as local data of the older app to be available in the renamed app (newer app) but I'm unable to find any appropriate way of doing so.

Lastly, There was a post in the community where the solution was to clone the local data from the older app to the newer app but that isn't feasible for me as I don't have access to the instances that the users are having with the older app installed.

Can someone please help me with this?

Also, I had a few other questions related to older applications:

What is the procedure for deleting an already existing application on Splunkbase?
1. Is emailing Splunk support the only way?
2. Tried app archiving but it doesn't restrict the users from installing it.
Is there a way to transfer the old Splunk application or account to a new account? any alternative to emailing the Splunk support team?

TL;DR

How can I replace the already installed application on the user's end with the newly renamed application in Splunk?

Since the names of the applications differ, Splunk installs a separate app for the new name instead of updating the existing one.

If there are users who are already using the existing application and have the application's saved configurations and searches, how can we get it migrated to the newly renamed application?

Re: Splunk application renaming without losing existing user data

isoutamo — Mon, 16 Dec 2024 22:03:40 GMT

as you have renamed and changed AppId then this is totally new application without any reference into the old one. There is no automatic way how you could migrate those all KOs from old app and especially from user private folders.

If those installations are in onprem then you could use e.g. this script/solution https://community.splunk.com/t5/Dashboards-Visualizations/Can-we-move-the-saved-searches-or-knowledge-objects-created/m-p/672741/highlight/true#M55102

You could try to modify this script to work remotely with Splunk Cloud, but it needs some work and I don’t be sure that can you even do it?

I have no experience how to remove app from splunkbase. Probably it can do with service request? At least you could update the old app and tell that everyone should use your new one.
r. Ismo

Re: Splunk application renaming without losing existing user data

PickleRick — Mon, 16 Dec 2024 23:16:10 GMT

Wait a second.

Splunkbase is a channel for application distribution. While in a standalone server setups you can pull an app directly from Splunkbase it's not meant to be your deployment server.

Trying to pull some tricks with application ID and renaming "in place" is a relatively ugly solution. Why not just release a new app and provide a docs for migration between those "versions"?

Re: Splunk application renaming without losing existing user data

Moogsoft — Wed, 18 Dec 2024 13:56:18 GMT

@PickleRick Thanks for the reply, Yes I meant the same; i.e. Splunkbase is a channel for application distribution.

I agree that we can release a new app along with migration steps. Still, I'm looking for a solution where the existing application user can seamlessly move to the newly renamed application without having to worry about replicating the same saved searches as well as the app setup to the newer app.

Re: Splunk application renaming without losing existing user data

Moogsoft — Wed, 18 Dec 2024 14:00:18 GMT

@isoutamo Thanks for the reply, I'm afraid to go with the scripts route, but I'll still check if there is any other solution I can find as I'm looking to move the existing users from the old application to the renamed one without much effort.

Re: Splunk application renaming without losing existing user data

isoutamo — Wed, 18 Dec 2024 17:03:27 GMT

It’s possible to do almost seamless migration for end users as I told in previous post. But it needs some manual work for admins and of course enough documentation for both.