Alerting

How to create app that creates Alerts and Dashboards

mufthmu
Path Finder

Hi,
I'm doing alerts & dashboards migration from one splunk server to another. In the past, I had to copy each dashboards and alerts manually and it took a long time to do since we had hundreds of them.
so I was tasked to create 3 separate Splunk apps, each will migrate one of the following (separately):
1. indexes
2. alerts
3. dashboards

Does anyone have a good approach on how to do this properly?
I wonder if a script will work and regarded as a Splunk app.
Thanks!

0 Karma

woodcock
Esteemed Legend

This is all way easier from the CLI. You can exploit btool to do something like this:

${SPLUNK_HOME}/bin/splunk btool savedesarches list --debug | grep to filter stuff like "etc/system/default" and "etc/system/local" > /tmp/savedsearches.conf

Now that they are all in a single file, create an appropriate app structure and properly segregate/aggregate them and then TRAIN YOUR USERS so that this will never happen again.

richgalloway
SplunkTrust
SplunkTrust

I think we need more information.

Is this migration on-prem to on-prem or on-prem to cloud?
Are you moving the entire Splunk instance or just some apps?
Do you have CLI access?
If you're migrating alerts & dashboards, why do you have a task to migrate indexes?

---
If this reply helps you, Karma would be appreciated.
0 Karma

mufthmu
Path Finder

Hi @richgalloway , thanks for the response.
This is migration from on prem to the cloud.
I'm only moving the alerts and dashboards inside the apps.
I do have CLI access and I can access both nodes.
My priority is now alerts and dashboards, as far as indexes, Im not quite sure why.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Since you have CLI access on both ends, you can just copy files. Look for $SPLUNK_HOME/etc/apps/*/local/* on the old system and copy them to the same locations on the new system. Any directory that doesn't exist on the new system is an app you probably need to install. Adjust file paths in the files as necessary.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...