How migrate dashboards of the Search App on a standalone dev Search Head to a Search Head Cluster?

[ishaanshekhar]

Dear SPLUNK Community,

I have one development Search Head and a Search Head Cluster in my cluster. I am using the default search app to create dashboards on a dev SH.

I create dashboards with the admin role and share it with all users within the App. I also use custom css, js, and images in the dashboards.

Could you please help me understand the best way to migrate the dashboards I develop in dev SH to SHC? (I do have a Deployer as well)

I read somewhere that since Search is a default app, I should not be pushing it to a SHC using the Deployer as it may override the app version.

Thank you so much!
Ishaan

[Steve_G_ · Accepted solution]

See the guidance offered here:

http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Migratefromstandalonesearchheads#Do_not...

Then follow step #2 in the next section and adapt the subsequent steps in that procedure to fit your need: http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Migratefromstandalonesearchheads#Migrat...

[chanfoli]

I have a similar problem migrating all of our dashboards which were created in search on pooled 6.0 search heads to clustered 6.3.0 search heads. I have attempted to ensure the steps described for getting objects out of the search app, putting them into a "search migration" app and pushing them to the search head cluster members as described but my dashboards are not visible to the original owner or admin user in the search context and I am not seeing how to get them to show up. I found references to the views in /$SPLUNK_HOME/etc/apps/search/metadata/local.meta so I also attempted to get these into the local.meta file for the "migration app", this apparently gets it pushed out and merged into the default.meta file but it does not fix the missing dashboards.

[maciep]

Were you planning to push those changes to the search app in the shc or to another app? or multiple different apps maybe?

In general, I would say don't use the search app. With that said, whatever other app you choose to push those changes to in the shc, I would have the same exact app on the dev box. And then once the changes look good, copy it over to the deployer and push out to the cluster.

[ishaanshekhar]

I do not have a separate app currently. I am using the Search app itself on the dev box. I understand it is not the ideal way, but would like to know how should I migrate my dashboards, js and css files in the shc from the dev box.

[maciep]

I would recommend against that. It should be easy enough to create a new app and copy the files over there. That said...

If not, then i would suggest you don't manage those files from the deployer. Instead just copy the files directly down to the search app on the members (may have to do a rolling restart before they're recognized, not sure). And then manually create the dashboards in Splunk Web on one of the cluster members (just copy/paste dashboard source to a new dashboard in the search app). The dashboards themselves will get replicated to the other members.

Technically, you probably could copy the search app from a member to the deployer. Place your files and dashboards there. Then push the entire search app back down to the members. But that just seems like a really bad idea and would likely cause you quite a headache later on.

[somesoni2]

You can now create a separate app and copy all the required objects into new app and push that app to the SH cluster, unless you want to have your dashboards available in the Search App only (if you've a choice, have it under specific app, rather than default search).