topic Exporting Splunk configurations in Splunk Search

Exporting Splunk configurations

alexsuv — Tue, 13 Oct 2015 01:52:49 GMT

I would like to export the Splunk for CEF configuration from one Splunk server, in order to import it to another Splunk.

I assume there is no way to export the config from the UI (please correct if it is wrong).

So I exported the all the files from the CLI /opt/splunk/etc/apps/splunk_app_cef/local:

zip -r config-app-for-cef.zip /opt/splunk/etc/apps/splunk_app_cef/local/*

Then, to import it, I paste all these files into the same dir.

Is this a correct and recommended method of exporting/importing?

Thank you.

Re: Exporting Splunk configurations

MuS — Tue, 13 Oct 2015 02:07:06 GMT

Hi alexsuv,

this is a good approach as long as you have CLI access to the server.
If not, you can try this app https://splunkbase.splunk.com/app/2613/ made by @martin_mueller it works just fine and your app is packaged and ready as a spl file.

Hope this helps ...

cheers, MuS

Re: Exporting Splunk configurations

martin_mueller — Tue, 13 Oct 2015 16:34:36 GMT

Grabbing the App Exporter linked above will let you do things through the UI entirely, assuming you can access your management port.

Do note, all approaches only copy settings shared within the app or globally, private settings won't be copied.

Re: Exporting Splunk configurations

masonmorales — Tue, 13 Oct 2015 16:39:14 GMT

I would suggest zip -r config-app-for-cef.zip /opt/splunk/etc/apps/splunk_app_cef/

If the app ships with default configurations, you won't have those if you only export the local folder. Zipping the entire $SPLUNK_HOME/etc/apps/MYAPP is the easiest manual way to copy app configurations over to another Splunk server.

Just make sure you restart Splunk on the target server in order for it to pickup the new app.

Re: Exporting Splunk configurations

alexsuv — Tue, 13 Oct 2015 18:25:47 GMT

Thank you 🙂