Alerting

What is the most efficient way to move all saved searches from one app to another?

mcm10285
Communicator

I have an app that contains saved searches (alerts). However, when I look into /$SPLUNKHOME/etc/apps/old_app/local/savedsearches.conf, I don't see all the saved searches I see in the UI settings (Settings - Searches, Reportsand Alerts).

Now I have a second app (new_app) and I would want all those saved searches from the old_app be moved/copied to this new_app. I know there is a "Move" and "Clone" functionality in the UI. But is there a better way?

Tags (2)
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

If you don't see certain saved searches in $SPLUNK_HOME/etc/apps/old_app/local/savedsearches.conf it's likely that those searches don't have the permissions you think they do... there are two views into saved searches. One, is from Settings> searches, reports and alerts, the other is from the app context, and that is the one that may clear this up.
Change to the app context (choose the app from the app pulldown or from the launcher)
If you still have the Reports menu item, click on that. (If you don't have it, add it back, just to make your troubleshooting more straight forward. (the item is `` from Settings>User Interface>Navigation Menus> default) also the url for the reports view is https://server_name/en-US/app/old_app/reports

When you look at the list from the Reports view there are three buttons up top:
All|Yours|This App's

Look at either "Yours" or "This App's"
"Yours" refers to the one's where you see your userid in the "Owner" column, you'll see the App name in the "App" column (because you are in the report view for that app) and then note the "Sharing" column. So you can have something belonging to the app, owned by you but the sharing setting is "private".

In that case, you'll find the saved searches in $SPLUNK_HOME/etc/users/youruserid/old_app/local/savedsearches.conf

Best thing to do is to change the permissions so that the searches in question are shared in the app. So click on the Edit link in the Actions Column and choose Edit Permissions...
Note you need to change "Displayed for" to App. You'll find your searches have been moved to $SPLUNK_HOME/etc/apps/old_app/local/savedsearches.conf

Then when you can either move them from the GUI or you can just move the contents of the savedsearches.conf from one app to the other.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...