topic Re: How to retrieve all apps and reports from the backup after uninstalling and reinstalling Splunk? in Installation

How to retrieve all apps and reports from the backup after uninstalling and reinstalling Splunk?

pbourit — Tue, 23 Jun 2020 22:07:00 GMT

We had to uninstall then reinstall Splunk recently. In order to be sure to not lose all apps and reports, we have to copy the entire Splunk field and we have created a *.spl for each app.

After the reinstallation, we have imported these *.spl and the Apps are created but totally empty! No reports, no search, nothing.

So, we assume we need to copy some files from the backup to the new Splunk folder, but which ones? How to find all of our research?

Thank you

Re: How to retrieve all apps and reports from the backup after uninstalling and reinstalling Splunk?

musskopf — Wed, 05 Nov 2014 21:47:26 GMT

Inside Splunk, you'll have a folder named etc/apps/. Inside each App's Folder, go to the local/ folder and you should be able to find all configuration files, saved searches, reports, etc there. You might also be interested in the lookups/ folder as well.

Re: How to retrieve all apps and reports from the backup after uninstalling and reinstalling Splunk?

pbourit — Fri, 07 Nov 2014 09:29:19 GMT

I am really disapointed : all files in the local folder are empty... It seems all my reports, searches etc... are not in the Apps folder (whereas they are all linked to this App). Where it can be ?

Re: How to retrieve all apps and reports from the backup after uninstalling and reinstalling Splunk?

musskopf — Sun, 09 Nov 2014 21:37:40 GMT

If they were all private objects, you might find those inside $SPLUNK_HOME/etc/users/<USERNAME>/<APPNAME>/local

For example, I have a private dashboard at:

/apps/splunk/etc/users/admin/search/local/data/ui/views/dev__printing.xml

Hope that helps.
Cheers