Hi,
I need your help for packaging a Splunk app while having the index or Data in Splunk App.
Is this possible?
Regards
There's a doc for that. See https://docs.splunk.com/Documentation/Splunk/7.2.1/Installation/MigrateaSplunkinstance
I'm not aware of a way to include an index in an app, but you can include sample data. Just create a directory called "samples" in your app and put the data files there.
yes its possible, to ship an index with a app you need to include indexes.conf file with below sample structure,
[demo_index]
coldPath = $SPLUNK_DB\demo_index\colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB\demo_index\db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB\demo_index\thaweddb
Sid
This doesn't ship an index itself, just the definition of an index. Also, it's against Best Practices to ship enabled index definitions.
ok, how could restore the data in other splunk 7.2?
What do you mean by "restore"? Are you trying to use Package App to migrate to a different server?
I need migrate the Splunk app & the data to a diferent server
Packaging an app is not for migration to a different server.