Exporting reports to a different search head... how do I cleanup the move and get rid of the search_migration app on SH2?

[packet_hunter]

So I successfully created an app called search_migration on SH1 to move reports to SH2.

1) I set all reports on SH1 (in search app) that I wanted to move as shared globally
2) I created an app called search_migration on SH1
3) I verified all reports were in search_migration
4) I copied the directory for search_migration app to a location where I could move it to SH2
5) I moved the search_migration app to SH2
6) I verified all reports are now populated under the search_app as well as the search_migration app on SH2

Here is my question, how do I cleanup the move and get rid of the search_migration app on SH2?

If I delete the search_migration app from SH2 then all the reports will disappear from the search app on SH2. Is there a way to change permissions on the reports so they will remain after I remove the search_migration app???

Thank you

[aholzer · Accepted solution]

Via the GUI you can use the "move" function to have the searches belong to a different app. Once you have "moved" all the searches this way, you can safely delete the migration_app without losing your searches.

You can get this "move" option by going to "settings > searches, reports, and alerts". I believe the Reports and/or Alerts dashboard from the default menu should also provide the "move" option.

Hope this helps

[packet_hunter]

Thanks, you are correct it does work. Do you know if there is a bulk move?

[aholzer]

Unfortunately not.

[packet_hunter]

I believe it has something to do with the metadata local files, but I am not sure if I should copy SH1 metadata to SH2....