Deployment Architecture

Exporting reports to a different search head... how do I cleanup the move and get rid of the search_migration app on SH2?

packet_hunter
Contributor

So I successfully created an app called search_migration on SH1 to move reports to SH2.

1) I set all reports on SH1 (in search app) that I wanted to move as shared globally
2) I created an app called search_migration on SH1
3) I verified all reports were in search_migration
4) I copied the directory for search_migration app to a location where I could move it to SH2
5) I moved the search_migration app to SH2
6) I verified all reports are now populated under the search_app as well as the search_migration app on SH2

Here is my question, how do I cleanup the move and get rid of the search_migration app on SH2?

If I delete the search_migration app from SH2 then all the reports will disappear from the search app on SH2. Is there a way to change permissions on the reports so they will remain after I remove the search_migration app???

Thank you

0 Karma
1 Solution

aholzer
Motivator

Via the GUI you can use the "move" function to have the searches belong to a different app. Once you have "moved" all the searches this way, you can safely delete the migration_app without losing your searches.

You can get this "move" option by going to "settings > searches, reports, and alerts". I believe the Reports and/or Alerts dashboard from the default menu should also provide the "move" option.

Hope this helps

View solution in original post

0 Karma

aholzer
Motivator

Via the GUI you can use the "move" function to have the searches belong to a different app. Once you have "moved" all the searches this way, you can safely delete the migration_app without losing your searches.

You can get this "move" option by going to "settings > searches, reports, and alerts". I believe the Reports and/or Alerts dashboard from the default menu should also provide the "move" option.

Hope this helps

0 Karma

packet_hunter
Contributor

Thanks, you are correct it does work. Do you know if there is a bulk move?

0 Karma

aholzer
Motivator

Unfortunately not.

0 Karma

packet_hunter
Contributor

I believe it has something to do with the metadata local files, but I am not sure if I should copy SH1 metadata to SH2....

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...