All Apps and Add-ons

How to move field extractions and dashboards from a Splunk Installation to another one?

fvasquezchacon
Path Finder

Hi!

I have some field extractions and dashboards on my current Splunk and I would like to move them to another laptop with Splunk as well. Is there a quick and easy form to do this duty? The new installation has the same indexed data.

Thanks in advance!

0 Karma
1 Solution

lguinn2
Legend

If you put the field extractions, dashboards (and any other knowledge objects that you want) into an app, you can then copy the app directory from one Splunk instance to another very easily.

First, create an app. I am calling it "myApp" in this example. Then clone or move each knowledge object to the new app. You might want to think about the permissions of the knowledge objects at this point, and set them as needed.

When finished, you will find your app under $SPLUNK_HOME/etc/myApp. You can zip it up or tar it or whatever. Now you can take that copy and put it on any other Splunk instance. Just be sure to put it in the same place: $SPLUNK_HOME/etc/myApp and then restart Splunk so it will pick up the new app.

View solution in original post

0 Karma

fvasquezchacon
Path Finder

Thank you so much. It works perfect.

In relation with this topic, you know if there is something equivalent for the timestamp and break event regex when indexing? I would like to save those too.

0 Karma

lguinn2
Legend

If you put the field extractions, dashboards (and any other knowledge objects that you want) into an app, you can then copy the app directory from one Splunk instance to another very easily.

First, create an app. I am calling it "myApp" in this example. Then clone or move each knowledge object to the new app. You might want to think about the permissions of the knowledge objects at this point, and set them as needed.

When finished, you will find your app under $SPLUNK_HOME/etc/myApp. You can zip it up or tar it or whatever. Now you can take that copy and put it on any other Splunk instance. Just be sure to put it in the same place: $SPLUNK_HOME/etc/myApp and then restart Splunk so it will pick up the new app.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...