All Apps and Add-ons

How do you package an App with an index or Data?

Carolina
Engager

Hi,

I need your help for packaging a Splunk app while having the index or Data in Splunk App.

Is this possible?

Regards

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's a doc for that. See https://docs.splunk.com/Documentation/Splunk/7.2.1/Installation/MigrateaSplunkinstance

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of a way to include an index in an app, but you can include sample data. Just create a directory called "samples" in your app and put the data files there.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

sdchakraborty
Contributor

yes its possible, to ship an index with a app you need to include indexes.conf file with below sample structure,

[demo_index]
coldPath = $SPLUNK_DB\demo_index\colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB\demo_index\db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB\demo_index\thaweddb

Sid

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This doesn't ship an index itself, just the definition of an index. Also, it's against Best Practices to ship enabled index definitions.

---
If this reply helps you, an upvote would be appreciated.

Carolina
Engager

ok, how could restore the data in other splunk 7.2?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What do you mean by "restore"? Are you trying to use Package App to migrate to a different server?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Carolina
Engager

I need migrate the Splunk app & the data to a diferent server

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Packaging an app is not for migration to a different server.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!