How to migrate knowledge objects (alerts, reports, dashboards etc) from Splunk cloud (prod) to Splunk cloud (non prod)?

[Sumana21]

I have a Splunk cloud environment (production) from which I want to migrate all my knowledge objects to my non-prod Splunk cloud instance without leveraging Splunk cloud support.. Are there any links, process, or any information around this type of migration?

[venkatasri · Accepted solution]

Hi @Sumana21 

There seems no specific guidance in docs, if your KO's are nicely already packaged in form of Apps, Add-ons then quick thought is to connect non-prod to PROD SH deployer and whitelist apps required to non-prod. So the apps will be downloaded to non-prod and later you can revoke access from prod SH deployer.

Same can be achieved through rsync from backend shell copying apps from prod to non-prod SH deployer. If Splunk cloud enables this level of access i hope not, this usually works on prem.

Having said that every KO's is different the prod might be having roles, users associated you shall create same roles, users etc or modify same in non-prod. There is no straight forward out of the box solution definitely Splunk support team will be able to help based on your set-up.

--

An upvote would be appreciated if it helps!