https://community.splunk.com/t5/Splunk-Search/Is-it-the-best-practice-to-import-savedsearches-conf-across/m-p/255899#M76632 <P>Hi All,</P> <P>I am new to Splunk and was looking for tutorials regarding Searching and Reporting on Splunk.</P> <P>My question here is when we write Splunk queries and save those reports it gets saved to savedsearches.conf file. For my continuous deployment across different environments (dev,qa), we need a mechanism to import and run these queries on different Splunk instances.</P> <P>Did some searching and found I could import/copy these savedsearches.conf to different instances and can see the reports/alerts created on host one is also coming up on host 2. Just want to know if this would be correct process to import all configuration across multiple Splunk servers?</P> <P>Do any other processes need to be met for the above requirement? Please share the documentation, if so.</P> Mon, 05 Dec 2016 20:49:56 GMT chitralekha 2016-12-05T20:49:56Z https://community.splunk.com/t5/Splunk-Search/Is-it-the-best-practice-to-import-savedsearches-conf-across/m-p/255899#M76632 <P>Hi All,</P> <P>I am new to Splunk and was looking for tutorials regarding Searching and Reporting on Splunk.</P> <P>My question here is when we write Splunk queries and save those reports it gets saved to savedsearches.conf file. For my continuous deployment across different environments (dev,qa), we need a mechanism to import and run these queries on different Splunk instances.</P> <P>Did some searching and found I could import/copy these savedsearches.conf to different instances and can see the reports/alerts created on host one is also coming up on host 2. Just want to know if this would be correct process to import all configuration across multiple Splunk servers?</P> <P>Do any other processes need to be met for the above requirement? Please share the documentation, if so.</P> Mon, 05 Dec 2016 20:49:56 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-the-best-practice-to-import-savedsearches-conf-across/m-p/255899#M76632 chitralekha 2016-12-05T20:49:56Z https://community.splunk.com/t5/Splunk-Search/Is-it-the-best-practice-to-import-savedsearches-conf-across/m-p/255900#M76633 <P>The closest article I can find to this is <A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/Migratefromstandalonesearchheads">Migrate from a standalone search head to a search head cluster</A> </P> <P>I would keep in mind that anything private is going under the etc/users directory, anything shared is under the etc/apps/ directory.<BR /> The <EM>metadata</EM> is also important in addition to the savedsearches.conf depending on what export settings you intend to use, I have moved searches around before and lost the owner/permissions on them by not including the metadata file...these are metdata/local.meta and metadata/default.meta in the relevant app directory...</P> Tue, 06 Dec 2016 00:02:26 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-the-best-practice-to-import-savedsearches-conf-across/m-p/255900#M76633 gjanders 2016-12-06T00:02:26Z https://community.splunk.com/t5/Splunk-Search/Is-it-the-best-practice-to-import-savedsearches-conf-across/m-p/255901#M76634 <P>thanks for mentioning about the meta data. So If we are saving any thing with app permission we should keep in mind migrating all the configuration present in $splunk_home/etc/apps/</P> Tue, 06 Dec 2016 00:24:52 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-the-best-practice-to-import-savedsearches-conf-across/m-p/255901#M76634 chitralekha 2016-12-06T00:24:52Z