All Apps and Add-ons

How to export "Splunk App for Stream" streams and forwarder groups configurations?

Path Finder

Hi All,

Due to security requirements we cannot have a single Streams App "Deployer" which all Streams Agents phone home to 



splunk_stream_app_location =
disabled = 0




In order to work around this network/security limitation we've had to install the Stream App on HFs in multiple network zones.


Question: To save us having to manually enter all the custom Streams and Forwarder Groups can we export from one instance and import to another?

From what I can tell they are in a kvstore based on the contents of this file




cat /opt/splunk/etc/apps/splunk_app_stream/default/collections.conf
# Splunk app KV Store collection file












Is it just a matter of exporting one or all of these collections?



# Export
/opt/splunk/bin/splunk backup kvstore -archiveName streams-streams-backup -collectionName streams -appName splunk_app_stream


/opt/splunk/bin/splunk backup kvstore -archiveName streams-forwardergroups-backup -collectionName streamforwardergroups -appName splunk_app_stream

# Then collect these backups from /opt/splunk/var/lib/splunk/kvstorebackup copy across to the other "Stream Deployer" then reimport with

/opt/splunk/bin/splunk restore kvstore -archiveName streams-streams-backup -collectionName streams -appName splunk_app_stream


/opt/splunk/bin/splunk restore kvstore -archiveName streams-forwardergroups-backup -collectionName streamforwardergroups -appName splunk_app_stream





Is there a better way or is this our only option?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...