topic Export saved (and scheduled) searches. Possible? in Splunk Search

Export saved (and scheduled) searches. Possible?

gfoligna0 — Mon, 08 Aug 2011 22:41:14 GMT

Hello everyone,

I'm working with Splunk and Nagios integrated (at Zappos), and we just changed our approach to monitor an application.
We have set up almost 70 scheduled searches but we need to disable, and then erase, all of them, but we don't need to lose those. So, I'm wondering if there's any chance that Scheduled Searches, and Saved Searches, could be exported from their .conf or wherever they are stored in order to add them back to Splunk in a near (or not that near) future.

I'll appreciate any input on this.

Thank you for you time. Cheers.

Gonzalo Foligna

Level 1 Operations Support - www.edrans.com

London: +44 20 3318 1571 | Buenos Aires: +54 11 5368 5839 - Ext. 8014

Re: Export saved (and scheduled) searches. Possible?

Ayn — Tue, 09 Aug 2011 05:06:52 GMT

All saved searches including their scheduling (if any), name, search parameters etc reside in savedsearches.conf. Create backups of these files and you will have effectively created backups of the saved searches themselves.

NOTE that, as you may know, like pretty much any Splunk configuration file savedsearches.conf can reside in multiple locations, so make sure you look in all the right places (for instance $SPLUNK_HOME/etc/apps/<yourApp>/local/savedsearches.conf would be likely if the saved searches reside inside a specific app).

Re: Export saved (and scheduled) searches. Possible?

gfoligna0 — Tue, 09 Aug 2011 22:35:52 GMT

Thanks! I'll check that and get back to you.

Re: Export saved (and scheduled) searches. Possible?

gfoligna0 — Thu, 11 Aug 2011 17:33:57 GMT

It works perfectly!

Thank you!