topic Can we save the extracted fields from one Splunk instance and import them to another Splunk instance? in Splunk Search

Can we save the extracted fields from one Splunk instance and import them to another Splunk instance?

varunnair26 — Mon, 03 Aug 2015 11:12:19 GMT

Can we save the extracted fields from one Splunk instance and import the same to another Splunk instance ?

Please let me know if the solution depends on license !

Re: Can we save the extracted fields from one Splunk instance and import them to another Splunk instance?

alacercogitatus — Mon, 03 Aug 2015 11:24:30 GMT

Extracted fields are pulled from props.conf and transforms.conf. So in theory and practice, you can transfer those files from one instance to another - no license impact at all. However, you have to make sure that ALL of the configurations are copied over from one to another. Install all the same apps, do diffs and rsyncs to transfer the files.

Re: Can we save the extracted fields from one Splunk instance and import them to another Splunk instance?

varunnair26 — Tue, 04 Aug 2015 06:02:39 GMT

Thank you.

Re: Can we save the extracted fields from one Splunk instance and import them to another Splunk instance?

koshyk — Tue, 04 Aug 2015 08:05:23 GMT

best is to package & deploy whole app.