How to move field extractions and dashboards from a Splunk Installation to another one?

[fvasquezchacon]

Hi!

I have some field extractions and dashboards on my current Splunk and I would like to move them to another laptop with Splunk as well. Is there a quick and easy form to do this duty? The new installation has the same indexed data.

Thanks in advance!

[fvasquezchacon]

Thank you so much. It works perfect.

In relation with this topic, you know if there is something equivalent for the timestamp and break event regex when indexing? I would like to save those too.

[lguinn2 · Accepted solution]

If you put the field extractions, dashboards (and any other knowledge objects that you want) into an app, you can then copy the app directory from one Splunk instance to another very easily.

First, create an app. I am calling it "myApp" in this example. Then clone or move each knowledge object to the new app. You might want to think about the permissions of the knowledge objects at this point, and set them as needed.

When finished, you will find your app under $SPLUNK_HOME/etc/myApp. You can zip it up or tar it or whatever. Now you can take that copy and put it on any other Splunk instance. Just be sure to put it in the same place: $SPLUNK_HOME/etc/myApp and then restart Splunk so it will pick up the new app.