topic Re: Export all alerts,reports and dashboards present in splunk UI in Monitoring Splunk

Export all alerts,reports and dashboards present in splunk UI

vineela — Mon, 11 Oct 2021 09:28:24 GMT

Hi All,

Actually in our splunk environment there is no test environment prior and now its present, So i need to replicate all the alerts,dashboards and reports present in production to test environment.
I didnt have access to backend environment of Splunk.
Is there any smarter way to do that instead of cloning each and every alert.
Waiting for response.

Thanks in Advance.

Re: Export all alerts,reports and dashboards present in splunk UI

richgalloway — Mon, 11 Oct 2021 13:14:43 GMT

The easiest and perhaps smartest way is to copy $SPLUNK_HOME/etc from one environment to the other. If you don't have access to the file system then try to find someone who does.

If that's not an option then consider using a backup app like https://splunkbase.splunk.com/app/5600. It will handle alerts and reports, but probably won't do dashboards so you may have to copy them yourself.

Re: Export all alerts,reports and dashboards present in splunk UI

vineela — Wed, 13 Oct 2021 03:28:31 GMT

I didnt have access to backend and cant do it and even i didnt have admin access to download base app.

can you suggest me the way or query to list out all the savedsearches from UI and check for cloning..whether its done or not.

There are 3 lower environments,how can we check whether the data is present for one app in all the environments,is there a way to check the same?

Thanks in Advance.

Re: Export all alerts,reports and dashboards present in splunk UI

richgalloway — Wed, 13 Oct 2021 13:29:47 GMT

List out the savedsearches using REST. What you will see may be limited by your role. This is where having admin access would be a benefit.

| rest /servicesNS/-/-/saved/searches splunk_server=local

There is no setting that indicates a saved search is a clone. The default name of a clone has "clone" in it, but is not a reliable indicator. The best you can do is look for identical search strings.

Comparing data for different environments does not have a Splunk solution. You'll have to export the results from each environment and use other tools to compare them.

Re: Export all alerts,reports and dashboards present in splunk UI

somesoni2 — Wed, 13 Oct 2021 14:00:04 GMT

Someone from your team or company should've admin access. Its much easier to get the information through them.