Best approach to transfer Knowledge objects and app from one search head cluster to another?

[vrmandadi]

Hello Splunkers ,

I am trying to figure out what is the best approach or steps to migrate all the knowledge objects(searches, dashboards , fields alias etc) and apps from one search head cluster to another search head cluster.

What would be the steps to perform and things to do in order to move them.

Thanks in advance 

[gcusello]

Hi @vrmandadi,

are you speaking of install an App in more SHCs (in different sites) or are you speaking of forwarding updates from one SHC to another?

If the first, you could use a Deployment Server to deploy the App to each Deployer, and Deployers will deploy App to the SHC memebers.

if the second, the only solution is to have one SHC in both the sites, so alignments will be automated.

Ciao.

Giuseppe

[vrmandadi]

Hello @gcusello  ...thank you for your reply . I am trying to migrate all the contents(KO,Dashboards,reports) from a search head cluster in a data center to a search head cluster which is in a  totally different data center 

[gcusello]

Hi @vrmandadi,

if you have to copy, one shot, the apps from a site to another, you can copy apps from a member of the first cluster to the deployer of the second and deploy them.

It's different to maintain aligned both the clusters, for this reason I hinted to have one cluster in both sides.

Ciao.

Giuseppe

[vrmandadi]

Thank you .So I just copy etc/apps folder from one of the search head in a SITE and then place that app in etc/shcluster/apps folder and then do a deploy?

[gcusello]

Hi @vrmandadi,

Yes, you have to copy only the apps to deploy, not the standard apps of splunk (e.g. splunkforwarder or search or launcher).

Remember to take the apps from a member of the first SHC not from the Deployer of the first SHC, and then copy them in the Deployer of the second SHC and deploy them.

Ciao.

Giuseppe