How to export/import saved searches REST API

[mforgues]

Hi,

I'm trying to found a way to export through the REST API my saved searches.

Running the following command seems to generate the correct export :

curl -k -u admin:changeme https : //localhost:8089/servicesNS/ocs/-/saved/searches > saved_searches

Now for the tricky part, I'm trying to adjust the file to import it back to another server.

Could you help me determine if this is possible?

Thanks,

Mathieu

[tro]

Is there any new way how to do it with recent Splunk version?

[martin_mueller]

You could use http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTapps#apps.2Flocal.2F.7Bname.7D.2Fpack... to package the app and install it on another server as any other app. Between those steps you can change savedsearches.conf in the archive as you need.

[mforgues]

curl -k -u admin:pass https://[Splunk Host]:[Management Port]/services/apps/local/{name}/package

+

https://[Splunk Host]:[Management Port]/static/app-packages/{name}.spl

Did the job 🙂

Thanks,

Mathieu