- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it possible to migrate saved searches' view settings (such as open as a chart, not in search view - and here are the chart settings) when migrating from 3.4.x to 4.1.x?
The client has a lot of saved searches in 3, and while they work in 4, they look nothing like they are supposed to. It's going to be very annoying if we (I) have to have a 3.x version open and a 4.x version open, trying to make one look like the other manually!
I thought auto-migrate moved viewstate.* to the viewstates.conf file, not just commented them out and deleted them...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Migration of views and dashboards from 3.x to 4.x was not easily and reliably achievable with a scripted solution. The changes in the UI were just too fast, and the new options too many for us to be able to reproduce exactly what was needed. Also, the UI was completely re-written so that it's now infinitely flexible and can display data any way you want, so this was also looked on as an opportunity to get people to build new dashboards and get familiar with the new UI.
The basic UI dashboard builder is pretty striaghforward if your searches aren't too complicated - http://www.splunk.com/base/Documentation/latest/User/CreateSimpleDashboards - just remember that any charts you build are driven by the search itself rather than the actual dashboard XML.
If more advanced dashboards are required, you'll just have to get your hands dirty with the XML.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Migration of views and dashboards from 3.x to 4.x was not easily and reliably achievable with a scripted solution. The changes in the UI were just too fast, and the new options too many for us to be able to reproduce exactly what was needed. Also, the UI was completely re-written so that it's now infinitely flexible and can display data any way you want, so this was also looked on as an opportunity to get people to build new dashboards and get familiar with the new UI.
The basic UI dashboard builder is pretty striaghforward if your searches aren't too complicated - http://www.splunk.com/base/Documentation/latest/User/CreateSimpleDashboards - just remember that any charts you build are driven by the search itself rather than the actual dashboard XML.
If more advanced dashboards are required, you'll just have to get your hands dirty with the XML.
