Is there a way to backup/export a dashboard

[mcdermottsteven]

I have a couple of dashboards that I want to migrate from one splunk instance to another.

Is there an easy way to backup/export a dashboard and recover/import it again?

[NK_1]

Splunk 6.1.3

Go to Dashboards. Edit selected dashboard, and pick "Edit Source (XML)".

In your new instance, create a dummy dashboard, go to Edit Source (XML), and paste this XML in there and Save.

Might be a good idea to version-control that XML source somewhere too.

[nils1433]

what worked for me was to convert the dashboard to an html (wich is not nessesary) and copy the text from the sourcefile to a .txt file on a flashdrive wich i carry with me 24/7, that way it can't be easily compromised and it's a way of backing up a dashboard while working with familliar filetypes and small file sizes. excuse me for the grammar.

when you want to retrieve a dashboard, you just take the .txt file, copy the contents of the file to your clipboard, create a new (HTML) dashboard and paste the contents of your clipboard in your newly created dasboard sourcecode.

[tmarlette]

I have had success in this using scripting languages.

We use perl / bash or if you have windows you can use batch files to copy the UI files mentioned above to a new location.

Also... keep in mind that if you don't share your UI views globally, they may also be in the
/opt/splunk/etc/users/< user name >/ folder

[sbrant_splunk]

Dashboards are stored on your Splunk search head in xml format. You can find them in $SPLUNK_HOME/etc/apps//local/data/ui/views

Note: If you have a default install and you haven't created your own apps, it's likely that your dashboards are in the search app.

[sbrant_splunk]

Your dashboards must exist in another app, other than search then. You can determine which app by looking at the URL when you're viewing the dashboard in question.

http://:8000/en-US/app//

[mcdermottsteven]

Ok So I do indeed have a default install so I'm looking in:

$SPLUNK_HOME/etc/apps/search/local/data/ui/views

But its empty. I see the saved searches are in the:

$SPLUNK_HOME/etc/apps/search/local/

folder in the savedsearches.conf & viewstates.conf files but I don't believe the dashboard files are there?