Alerting

Migrate All Alerts from one instance to other instance

snehalk
Communicator

Hello Everyone,

i need to migrate only alerts from one instance to other instance , from this link http://answers.splunk.com/answers/141246/transferring-alerts-from-one-instance-to-another.html

we can export all like dashboard,views and all. but i need to export only alerts. Can any one help me one this?

Thank you

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi snehalk,

all alerts are setup in your savedsearches.conf (there could by multiple files!) you must check for any action.* items, because this will define an alert. Copy all stanzas into a new savedsearches.conf file and move that to the new server.

See the docs for details http://docs.splunk.com/Documentation/Splunk/6.2.0/Alert/Configuringalertsinsavedsearches.conf

hope this helps ...

cheers, MuS

View solution in original post

brent_weaver
Builder

Great post but how do you move this to a seachhead cluster where we need the directories to stay in sync? My savedsearches.conf is under my user folder within splunk on the old system. How do I migrate that to ensure that it syncs with the other nodes?

0 Karma

MuS
Legend

Hi brent_weaver, the answer did not consider SHC. But you can find the information in the docs ( as always ! ) :
From http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/HowconfrepoworksinSHC

Note: The deployer works in concert with cluster replication to migrate user (not app) configurations to the cluster members. The typical use case for this is to migrate user settings on an existing search head pool or standalone search head to the search head cluster. You put the user configurations that you want to migrate on the deployer. The deployer pushes them to the captain, which then replicates them to the other cluster members. For details, see "User configurations."

Next page can be found here http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/PropagateSHCconfigurationchanges#User_c...

cheers, MuS

0 Karma

MuS
Legend

Hi snehalk,

all alerts are setup in your savedsearches.conf (there could by multiple files!) you must check for any action.* items, because this will define an alert. Copy all stanzas into a new savedsearches.conf file and move that to the new server.

See the docs for details http://docs.splunk.com/Documentation/Splunk/6.2.0/Alert/Configuringalertsinsavedsearches.conf

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...