Migrating existing splunk reports (around 70) to new environment

[assrinivas]

Hi

I am new to splunk with basic idea.

I have been assigned a new project (banking domain) on splunk.

Background is, existing splunk environment is being maintained by one vendor and his contract got over and we are taking over.

We are going to get new hardware from the customer

1. Need to set up the splunk environment (QA/Production) on Linux operating system
2. Migrate the existing splunk reports(70) to newly set up environment.

Please help me on the above requirements. I have gone through some splunk videos to get some idea. Since I do not have hands on, I am a bit nervous. please help me with the steps.

Thanks&Regards
Srinivas

[vishaltaneja070 · Accepted solution]

@assrinivas

if you want to migrate only report, then the reports configuration is saved in savedsearches.conf file. So you can copy
savedsearches.conf file from the old instance to the new instance.

you have to copy it from all apps. Location will be \opt\splunk\etc\system\local AND \opt\splunk\etc\apps\<app_name>\<local\default>

[assrinivas]

Thank you so much for the response. I will follow the steps as you mentioned.

[assrinivas]

Hi

In continuation to the above requirement, I think we need to migrate everything from existing setup to the new one not only reports.

Please help me with what and all I will have to migrate and how to migrate (like reports).

Thanks&Regards
Srinivas