Deployment Architecture

Exporting reports to a different search head... how do I cleanup the move and get rid of the search_migration app on SH2?

packet_hunter
Contributor

So I successfully created an app called search_migration on SH1 to move reports to SH2.

1) I set all reports on SH1 (in search app) that I wanted to move as shared globally
2) I created an app called search_migration on SH1
3) I verified all reports were in search_migration
4) I copied the directory for search_migration app to a location where I could move it to SH2
5) I moved the search_migration app to SH2
6) I verified all reports are now populated under the search_app as well as the search_migration app on SH2

Here is my question, how do I cleanup the move and get rid of the search_migration app on SH2?

If I delete the search_migration app from SH2 then all the reports will disappear from the search app on SH2. Is there a way to change permissions on the reports so they will remain after I remove the search_migration app???

Thank you

0 Karma
1 Solution

aholzer
Motivator

Via the GUI you can use the "move" function to have the searches belong to a different app. Once you have "moved" all the searches this way, you can safely delete the migration_app without losing your searches.

You can get this "move" option by going to "settings > searches, reports, and alerts". I believe the Reports and/or Alerts dashboard from the default menu should also provide the "move" option.

Hope this helps

View solution in original post

0 Karma

aholzer
Motivator

Via the GUI you can use the "move" function to have the searches belong to a different app. Once you have "moved" all the searches this way, you can safely delete the migration_app without losing your searches.

You can get this "move" option by going to "settings > searches, reports, and alerts". I believe the Reports and/or Alerts dashboard from the default menu should also provide the "move" option.

Hope this helps

0 Karma

packet_hunter
Contributor

Thanks, you are correct it does work. Do you know if there is a bulk move?

0 Karma

aholzer
Motivator

Unfortunately not.

0 Karma

packet_hunter
Contributor

I believe it has something to do with the metadata local files, but I am not sure if I should copy SH1 metadata to SH2....

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...