topic Re: Migrating existing splunk reports (around 70) to new environment in Getting Data In

Migrating existing splunk reports (around 70) to new environment

assrinivas — Wed, 17 Apr 2019 05:52:59 GMT

I am new to splunk with basic idea.

I have been assigned a new project (banking domain) on splunk.

Background is, existing splunk environment is being maintained by one vendor and his contract got over and we are taking over.

We are going to get new hardware from the customer

Need to set up the splunk environment (QA/Production) on Linux operating system
Migrate the existing splunk reports(70) to newly set up environment.

Please help me on the above requirements. I have gone through some splunk videos to get some idea. Since I do not have hands on, I am a bit nervous. please help me with the steps.

Thanks&Regards
Srinivas

Re: Migrating existing splunk reports (around 70) to new environment

vishaltaneja070 — Wed, 17 Apr 2019 14:13:50 GMT

@assrinivas

if you want to migrate only report, then the reports configuration is saved in savedsearches.conf file. So you can copy
savedsearches.conf file from the old instance to the new instance.

you have to copy it from all apps. Location will be \opt\splunk\etc\system\local AND \opt\splunk\etc\apps\<app_name>\<local\default>

Re: Migrating existing splunk reports (around 70) to new environment

assrinivas — Thu, 18 Apr 2019 05:24:04 GMT

Thank you so much for the response. I will follow the steps as you mentioned.

Re: Migrating existing splunk reports (around 70) to new environment

assrinivas — Thu, 30 May 2019 06:21:04 GMT

In continuation to the above requirement, I think we need to migrate everything from existing setup to the new one not only reports.

Please help me with what and all I will have to migrate and how to migrate (like reports).

Thanks&Regards
Srinivas