All Apps and Add-ons

How to move field extractions and dashboards from a Splunk Installation to another one?

Path Finder

Hi!

I have some field extractions and dashboards on my current Splunk and I would like to move them to another laptop with Splunk as well. Is there a quick and easy form to do this duty? The new installation has the same indexed data.

Thanks in advance!

0 Karma
1 Solution

Legend

If you put the field extractions, dashboards (and any other knowledge objects that you want) into an app, you can then copy the app directory from one Splunk instance to another very easily.

First, create an app. I am calling it "myApp" in this example. Then clone or move each knowledge object to the new app. You might want to think about the permissions of the knowledge objects at this point, and set them as needed.

When finished, you will find your app under $SPLUNK_HOME/etc/myApp. You can zip it up or tar it or whatever. Now you can take that copy and put it on any other Splunk instance. Just be sure to put it in the same place: $SPLUNK_HOME/etc/myApp and then restart Splunk so it will pick up the new app.

View solution in original post

0 Karma

Path Finder

Thank you so much. It works perfect.

In relation with this topic, you know if there is something equivalent for the timestamp and break event regex when indexing? I would like to save those too.

0 Karma

Legend

If you put the field extractions, dashboards (and any other knowledge objects that you want) into an app, you can then copy the app directory from one Splunk instance to another very easily.

First, create an app. I am calling it "myApp" in this example. Then clone or move each knowledge object to the new app. You might want to think about the permissions of the knowledge objects at this point, and set them as needed.

When finished, you will find your app under $SPLUNK_HOME/etc/myApp. You can zip it up or tar it or whatever. Now you can take that copy and put it on any other Splunk instance. Just be sure to put it in the same place: $SPLUNK_HOME/etc/myApp and then restart Splunk so it will pick up the new app.

View solution in original post

0 Karma