It depends if the saved searches etc is your private or in an app.
if private then you could move just your own folder under
to the new Server.
If it is an app then you should move the whole app you want to move to the new server
Thanks Elsurion for your reply.
if i copied entire app into another server will it automatically move all saved searches and macros into my new server app ? and what about index data back up bro ???
When the saved searches are stored in the app context yes, if not move them in the correct app context. either by move it from the wrong app to the correct or with the permissions from private to app.
When you save a search you can set the permissions, where you have three options.
When you copy the app to the new location and restart splunk, splunk will read the added configuration and add it to the available stuff.
The point about the indexed data will be answered in the other answer related to the question.
The indexes are stored (normaly) under
When you want to move this data as well just follow this short howto.
Do not move the Data from A to B, since it could be that you make a mistake and in that case you would loos all data.
All Splunk's configuration information is contained in configuration files. To back up the set of configuration files, make an archive or copy of
$SPLUNK_HOME/etc/. This directory, along with its subdirectories, contains all the default and custom settings for your Splunk install, and all apps, including saved searches, user accounts, tags, custom source type names, and other configuration information.
Copy this directory to a new Splunk instance to restore. You don't have to stop Splunk to do this.
For more information about configuration files, read "About configuration files".
let me know if this helps!
If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.