I have multiple Environments each with a distributed deployment with various indexers, search heads and forwarders. I like many have setup alot of apps and dashboards in my DEV/UAT environment. My question is I want to use the same Dashboards and Apps in my other Environments i.e. IAT, PROD etc..
I know you can easily export the dashboard XML and searches and write them into the envirnonments and then download the actual apps on the deployment server in each environment and push out but I was wondering if anyone knew of a more structured way to do both without basically starting over in each environment.
While I don't know your deployment topology (distributed deployment or not, or even if you have multiple deployment servers)...
In a distributed deployment, which most large enterprise environments have due to having data collected from multiple data centers, method 2 might be your best bet!
Dashboards shared within an app or globally will get moved over after exporting the app from one stage and importing it in the next. You can verify this by looking at
$SPLUNK_HOME/etc/apps/your_app/local/data/ui/views, this should contain your XML files. Export the app using the App Exporter I linked to above, grab the .spl file, open it with a tar.gz capable tool and navigate to the same path - you should find your XML files again.
2 seems the most logical. They are not version controlled. However, what about the dashboards I created in my App in DEV what is the best way to move them over. Is this just copying the XML over or would moving the apps include the dashboards associated with those apps?