Divide search app into multiple apps of Alerts and Dashboards

[mufthmu]

Hi,
I am planning to create 3 separate child apps from the Search app.
Basically one app dedicated to Alerts, and the other two are for Dashboards and Indexes.
I tried to make a tar file consisting of all the Alerts from the Search app. But when I upload and install the tar (as an app) thru the UI, there is nothing there as if it's just a fresh blank app.
Does anyone have an idea?
Thanks in advance

[gcusello]

Hi @mufthmu,
at first, did you followed all the steps in app creation ( https://dev.splunk.com/enterprise/docs/releaseapps/packagingtoolkit )?
probably there's an error in app creation (there must be two embedded tars: the first having as output tar extension and the second tar.gz extension).
You can test if it's all ok, copying the untared app in $SPLUNK_HOME/etc/apps folder and restarting Splunk: if it runs there's an error in tar, if instead it continuea to not work there's a problem in knowledge objects.

Anyway, It isn't a good practice to use the Search App for dashboards or alerts.
At the same time It isn't a good idea to have dashboards and alerts in different apps because you have to duplicate knowledge objects (fields, eventtypes, etc...) or to share them between apps.

The best approach is to have different apps for different uses cases and if you have different objects, or grants.

When I have to do dashboards or alerts, I usually create a new app (an app is an empty container!) and I create all my knowledge objects inside the app so it's easy to move and to manage it.

Ciao.
Giuseppe