topic Re: version controlling my search definitions? in Knowledge Management

version controlling my search definitions?

matt_arguin — Wed, 05 Dec 2012 18:31:06 GMT

I am trying to find where my search definitions are kept and if there is way that i can put them in version control (in my case, SVN) so that they are included in our continuous integration. Is this possible or are the definitions rows in a db?

Re: version controlling my search definitions?

kristian_kolb — Wed, 05 Dec 2012 21:52:34 GMT

Are you talking about savedsearches.conf?

That file exists in several places, typically in;

/etc/apps/<appname>/local
/etc/system/local
/etc/users/<username>/<appname>/local

Normally no need to look in the corresponding default directories, except for apps that you yourself create.

Hope this helps,

Kristian

Re: version controlling my search definitions?

matt_arguin — Thu, 06 Dec 2012 13:23:01 GMT

that's the file... i thought i had looked there, but didn't see anything. going back to double check...

Re: version controlling my search definitions?

matt_arguin — Thu, 06 Dec 2012 13:31:02 GMT

ok, well i don't know what the heck i was looking at before, but, yeah..found all the savesearches.conf's. thanks!

Re: version controlling my search definitions?

Marinus — Fri, 07 Dec 2012 13:19:01 GMT

I prefer to keep them in a custom app, which you can easily move around.
On the source you can also use something like GIT, to manage not just searches but config files also.

Marinus

Re: version controlling my search definitions?

matt_arguin — Fri, 07 Dec 2012 14:25:41 GMT

Thanks Marinus, we are putting them in to puppet which in turn is VC'd in SVN (both the configs and the config searches).

Re: version controlling my search definitions?

cmeo — Wed, 10 Apr 2013 01:41:03 GMT

I've been looking at questions and answers about version control of knowledge in Splunk and frankly it's weak to non-existent. There's nothing in the BUI and you're on your own with text files. On non-*x platforms where svn, git, even rcs and make (for placing files) are unknown, this is getting to be a large problem with our customers especially after a few years cranking away developing their own knowledge artifacts. From what I've seen of sourcesafe and other windowsy things, you do not want to go down that road if you can avoid it. So, how about an RFE to include even very basic version control in the BUI so that your latest and maybe a couple of previous diffs of your conf files get stored somewehere, and you can roll back if you want? I shouldn't think this would be much of a stretch, and for extra credit some hooks into popular version control systems would be REALLY nice...:-) SoS is only a partial answer at best and points the way to something better.