topic Re: How to create app that creates Alerts and Dashboards in Alerting

How to create app that creates Alerts and Dashboards

mufthmu — Tue, 31 Dec 2019 19:51:50 GMT

Hi,
I'm doing alerts & dashboards migration from one splunk server to another. In the past, I had to copy each dashboards and alerts manually and it took a long time to do since we had hundreds of them.
so I was tasked to create 3 separate Splunk apps, each will migrate one of the following (separately):
1. indexes
2. alerts
3. dashboards

Does anyone have a good approach on how to do this properly?
I wonder if a script will work and regarded as a Splunk app.
Thanks!

Re: How to create app that creates Alerts and Dashboards

richgalloway — Tue, 31 Dec 2019 21:29:17 GMT

I think we need more information.

Is this migration on-prem to on-prem or on-prem to cloud?
Are you moving the entire Splunk instance or just some apps?
Do you have CLI access?
If you're migrating alerts & dashboards, why do you have a task to migrate indexes?

Re: How to create app that creates Alerts and Dashboards

mufthmu — Wed, 01 Jan 2020 23:38:19 GMT

Hi @richgalloway , thanks for the response.
This is migration from on prem to the cloud.
I'm only moving the alerts and dashboards inside the apps.
I do have CLI access and I can access both nodes.
My priority is now alerts and dashboards, as far as indexes, Im not quite sure why.

Re: How to create app that creates Alerts and Dashboards

woodcock — Thu, 02 Jan 2020 02:12:33 GMT

This is all way easier from the CLI. You can exploit btool to do something like this:

${SPLUNK_HOME}/bin/splunk btool savedesarches list --debug | grep to filter stuff like "etc/system/default" and "etc/system/local" > /tmp/savedsearches.conf

Now that they are all in a single file, create an appropriate app structure and properly segregate/aggregate them and then TRAIN YOUR USERS so that this will never happen again.

Re: How to create app that creates Alerts and Dashboards

richgalloway — Thu, 02 Jan 2020 13:40:08 GMT

Since you have CLI access on both ends, you can just copy files. Look for $SPLUNK_HOME/etc/apps/*/local/* on the old system and copy them to the same locations on the new system. Any directory that doesn't exist on the new system is an app you probably need to install. Adjust file paths in the files as necessary.