Installation

How to retrieve all apps and reports from the backup after uninstalling and reinstalling Splunk?

New Member

Hi

We had to uninstall then reinstall Splunk recently. In order to be sure to not lose all apps and reports, we have to copy the entire Splunk field and we have created a *.spl for each app.

After the reinstallation, we have imported these *.spl and the Apps are created but totally empty! No reports, no search, nothing.

So, we assume we need to copy some files from the backup to the new Splunk folder, but which ones? How to find all of our research?

Thank you

Labels (2)
0 Karma

Builder

Inside Splunk, you'll have a folder named etc/apps/. Inside each App's Folder, go to the local/ folder and you should be able to find all configuration files, saved searches, reports, etc there. You might also be interested in the lookups/ folder as well.

0 Karma

Builder

If they were all private objects, you might find those inside $SPLUNK_HOME/etc/users/<USERNAME>/<APPNAME>/local

For example, I have a private dashboard at:

/apps/splunk/etc/users/admin/search/local/data/ui/views/dev__printing.xml

Hope that helps.
Cheers

New Member

I am really disapointed : all files in the local folder are empty... It seems all my reports, searches etc... are not in the Apps folder (whereas they are all linked to this App). Where it can be ?

0 Karma