Dashboards & Visualizations

Divide search app into multiple apps of Alerts and Dashboards

mufthmu
Path Finder

Hi,
I am planning to create 3 separate child apps from the Search app.
Basically one app dedicated to Alerts, and the other two are for Dashboards and Indexes.
I tried to make a tar file consisting of all the Alerts from the Search app. But when I upload and install the tar (as an app) thru the UI, there is nothing there as if it's just a fresh blank app.
Does anyone have an idea?
Thanks in advance

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mufthmu,
at first, did you followed all the steps in app creation ( https://dev.splunk.com/enterprise/docs/releaseapps/packagingtoolkit )?
probably there's an error in app creation (there must be two embedded tars: the first having as output tar extension and the second tar.gz extension).
You can test if it's all ok, copying the untared app in $SPLUNK_HOME/etc/apps folder and restarting Splunk: if it runs there's an error in tar, if instead it continuea to not work there's a problem in knowledge objects.

Anyway, It isn't a good practice to use the Search App for dashboards or alerts.
At the same time It isn't a good idea to have dashboards and alerts in different apps because you have to duplicate knowledge objects (fields, eventtypes, etc...) or to share them between apps.

The best approach is to have different apps for different uses cases and if you have different objects, or grants.

When I have to do dashboards or alerts, I usually create a new app (an app is an empty container!) and I create all my knowledge objects inside the app so it's easy to move and to manage it.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...