All Apps and Add-ons

How do you package an App with an index or Data?

Carolina
Engager

Hi,

I need your help for packaging a Splunk app while having the index or Data in Splunk App.

Is this possible?

Regards

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's a doc for that. See https://docs.splunk.com/Documentation/Splunk/7.2.1/Installation/MigrateaSplunkinstance

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of a way to include an index in an app, but you can include sample data. Just create a directory called "samples" in your app and put the data files there.

---
If this reply helps you, Karma would be appreciated.
0 Karma

sdchakraborty
Contributor

yes its possible, to ship an index with a app you need to include indexes.conf file with below sample structure,

[demo_index]
coldPath = $SPLUNK_DB\demo_index\colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB\demo_index\db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB\demo_index\thaweddb

Sid

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This doesn't ship an index itself, just the definition of an index. Also, it's against Best Practices to ship enabled index definitions.

---
If this reply helps you, Karma would be appreciated.

Carolina
Engager

ok, how could restore the data in other splunk 7.2?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What do you mean by "restore"? Are you trying to use Package App to migrate to a different server?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Carolina
Engager

I need migrate the Splunk app & the data to a diferent server

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Packaging an app is not for migration to a different server.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...