All Apps and Add-ons

How to move field extractions and dashboards from a Splunk Installation to another one?

fvasquezchacon
Path Finder

Hi!

I have some field extractions and dashboards on my current Splunk and I would like to move them to another laptop with Splunk as well. Is there a quick and easy form to do this duty? The new installation has the same indexed data.

Thanks in advance!

0 Karma
1 Solution

lguinn2
Legend

If you put the field extractions, dashboards (and any other knowledge objects that you want) into an app, you can then copy the app directory from one Splunk instance to another very easily.

First, create an app. I am calling it "myApp" in this example. Then clone or move each knowledge object to the new app. You might want to think about the permissions of the knowledge objects at this point, and set them as needed.

When finished, you will find your app under $SPLUNK_HOME/etc/myApp. You can zip it up or tar it or whatever. Now you can take that copy and put it on any other Splunk instance. Just be sure to put it in the same place: $SPLUNK_HOME/etc/myApp and then restart Splunk so it will pick up the new app.

View solution in original post

0 Karma

fvasquezchacon
Path Finder

Thank you so much. It works perfect.

In relation with this topic, you know if there is something equivalent for the timestamp and break event regex when indexing? I would like to save those too.

0 Karma

lguinn2
Legend

If you put the field extractions, dashboards (and any other knowledge objects that you want) into an app, you can then copy the app directory from one Splunk instance to another very easily.

First, create an app. I am calling it "myApp" in this example. Then clone or move each knowledge object to the new app. You might want to think about the permissions of the knowledge objects at this point, and set them as needed.

When finished, you will find your app under $SPLUNK_HOME/etc/myApp. You can zip it up or tar it or whatever. Now you can take that copy and put it on any other Splunk instance. Just be sure to put it in the same place: $SPLUNK_HOME/etc/myApp and then restart Splunk so it will pick up the new app.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...