Hi All,
I am trying to move my entire project code into another server .So how can i arrange that set up .
Mainly What i want is How can i take saved searches backup ,macros backup and index backup with out creating again.
hey
All Splunk's configuration information is contained in configuration files. To back up the set of configuration files, make an archive or copy of $SPLUNK_HOME/etc/
. This directory, along with its subdirectories, contains all the default and custom settings for your Splunk install, and all apps, including saved searches, user accounts, tags, custom source type names, and other configuration information.
Copy this directory to a new Splunk instance to restore. You don't have to stop Splunk to do this.
For more information about configuration files, read "About configuration files".
let me know if this helps!
Yes mayurr98 ,its help me alot
If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.
Thanks Elsurion .
what about index data backup?
The indexes are stored (normaly) under
/opt/splunk/var/lib/splunk/<your_index>
When you want to move this data as well just follow this short howto.
Do not move the Data from A to B, since it could be that you make a mistake and in that case you would loos all data.
Thanks Elsurion
It depends if the saved searches etc is your private or in an app.
if private then you could move just your own folder under
/opt/splunk/etc/users/<your_user>
to the new Server.
If it is an app then you should move the whole app you want to move to the new server
/opt/splunk/etc/apps/<your_app>
Thanks Elsurion for your reply.
if i copied entire app into another server will it automatically move all saved searches and macros into my new server app ? and what about index data back up bro ???
When the saved searches are stored in the app context yes, if not move them in the correct app context. either by move it from the wrong app to the correct or with the permissions from private to app.
When you save a search you can set the permissions, where you have three options.
When you copy the app to the new location and restart splunk, splunk will read the added configuration and add it to the available stuff.
The point about the indexed data will be answered in the other answer related to the question.