Deployment Architecture
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

How do you migrate searches, dashboards, etc. from a standalone search head to a new search head cluster?

SplunkShawnCt
Explorer

Can I move the /splunk/etc/apps/search/local folder to the deployers shcluster/apps/search/local folder? (And then push package?)

Reading the documentation it seems this would be a bad idea, but I want to move the savedsearches.conf, macros etc.

Or would it be a better idea to copy these folders to the search heads individually and restart Splunk?

This is from docs:

Caution: Do not use the deployer to
push default apps, such as the search
app, to the cluster members. In
addition, make sure that no app in the
configuration bundle has the same name
as a default app. Otherwise, it will
overwrite that app on the cluster
members. For example, if you create an
app called "search" in the
configuration bundle, it will
overwrite the default search app when
you push it to the cluster members.

0 Karma

dkeck
Influencer

HI,

I guess you had a look at this: https://docs.splunk.com/Documentation/Splunk/7.2.3/DistSearch/Migratefromstandalonesearchheads

If you read futher down its says: You can migrate custom settings in the app itself by moving them to a new app and exporting them globally. The migration procedure in this topic includes a step for this.

So just perform whats stated here: https://docs.splunk.com/Documentation/Splunk/7.2.3/DistSearch/Migratefromstandalonesearchheads#Migra...

dkeck
Influencer

any luck with that? Please accept the answer if it helped 🙂

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!