How to retrieve all apps and reports from the backup after uninstalling and reinstalling Splunk?

[pbourit]

Hi

We had to uninstall then reinstall Splunk recently. In order to be sure to not lose all apps and reports, we have to copy the entire Splunk field and we have created a *.spl for each app.

After the reinstallation, we have imported these *.spl and the Apps are created but totally empty! No reports, no search, nothing.

So, we assume we need to copy some files from the backup to the new Splunk folder, but which ones? How to find all of our research?

Thank you

[musskopf]

Inside Splunk, you'll have a folder named etc/apps/. Inside each App's Folder, go to the local/ folder and you should be able to find all configuration files, saved searches, reports, etc there. You might also be interested in the lookups/ folder as well.

[musskopf]

If they were all private objects, you might find those inside $SPLUNK_HOME/etc/users/<USERNAME>/<APPNAME>/local

For example, I have a private dashboard at:

/apps/splunk/etc/users/admin/search/local/data/ui/views/dev__printing.xml

Hope that helps.
Cheers

[pbourit]

I am really disapointed : all files in the local folder are empty... It seems all my reports, searches etc... are not in the Apps folder (whereas they are all linked to this App). Where it can be ?