How do you package an App with an index or Data?

[Carolina]

Hi,

I need your help for packaging a Splunk app while having the index or Data in Splunk App.

Is this possible?

Regards

[richgalloway]

There's a doc for that. See https://docs.splunk.com/Documentation/Splunk/7.2.1/Installation/MigrateaSplunkinstance

[richgalloway]

I'm not aware of a way to include an index in an app, but you can include sample data. Just create a directory called "samples" in your app and put the data files there.

[sdchakraborty]

yes its possible, to ship an index with a app you need to include indexes.conf file with below sample structure,

[demo_index]
coldPath = $SPLUNK_DB\demo_index\colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB\demo_index\db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB\demo_index\thaweddb

Sid

[richgalloway]

This doesn't ship an index itself, just the definition of an index. Also, it's against Best Practices to ship enabled index definitions.

[Carolina]

ok, how could restore the data in other splunk 7.2?

[richgalloway]

What do you mean by "restore"? Are you trying to use Package App to migrate to a different server?

[Carolina]

I need migrate the Splunk app & the data to a diferent server

[richgalloway]

Packaging an app is not for migration to a different server.