Deployment Architecture

What is the best process for transferring apps and user data to new search heads in AWS?

goodsellt
Contributor

We're planning on setting up replacement search heads in AWS for some current on prem search heads being phased out. Our plan was to copy over the etc/apps directory and the etc/users folder so we would transfer the apps and user data over (all the config info is also stored in etc/apps so we don't need to transfer auth or system).

Has anyone tried this method and know if it will work as we plan on doing it? In our case the servers will have different names and GUIDs so I'm not sure how that will affect the objects.

0 Karma
1 Solution

woodcock
Esteemed Legend

Assuming that no setup.xml was in the app (most do not have this), then just copy it directly from $SPLUNK_HOME/etc/apps/* from CLI. You do not even have to stop splunk on the source Search Head. If you only have GUI, then use this great app:

https://splunkbase.splunk.com/app/2613/

View solution in original post

0 Karma

woodcock
Esteemed Legend

Assuming that no setup.xml was in the app (most do not have this), then just copy it directly from $SPLUNK_HOME/etc/apps/* from CLI. You do not even have to stop splunk on the source Search Head. If you only have GUI, then use this great app:

https://splunkbase.splunk.com/app/2613/

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...