Migrate All Alerts from one instance to other instance

[snehalk]

Hello Everyone,

i need to migrate only alerts from one instance to other instance , from this link http://answers.splunk.com/answers/141246/transferring-alerts-from-one-instance-to-another.html

we can export all like dashboard,views and all. but i need to export only alerts. Can any one help me one this?

Thank you

[brent_weaver]

Great post but how do you move this to a seachhead cluster where we need the directories to stay in sync? My savedsearches.conf is under my user folder within splunk on the old system. How do I migrate that to ensure that it syncs with the other nodes?

[MuS]

Hi brent_weaver, the answer did not consider SHC. But you can find the information in the docs ( as always ! ) :
From http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/HowconfrepoworksinSHC

Note: The deployer works in concert with cluster replication to migrate user (not app) configurations to the cluster members. The typical use case for this is to migrate user settings on an existing search head pool or standalone search head to the search head cluster. You put the user configurations that you want to migrate on the deployer. The deployer pushes them to the captain, which then replicates them to the other cluster members. For details, see "User configurations."

Next page can be found here http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/PropagateSHCconfigurationchanges#User_c...

cheers, MuS

[MuS · Accepted solution]

Hi snehalk,

all alerts are setup in your savedsearches.conf (there could by multiple files!) you must check for any action.* items, because this will define an alert. Copy all stanzas into a new savedsearches.conf file and move that to the new server.

See the docs for details http://docs.splunk.com/Documentation/Splunk/6.2.0/Alert/Configuringalertsinsavedsearches.conf

hope this helps ...

cheers, MuS