How to move knowledge objects in bulk to another app?

[nwales]

Any ideas on how this can be achieved? The majority of objects reside in the search app. We are getting people used to using separate apps which means we have a load of moving to do.

[chimell]

Hi nwales

To move knowledge objects in bulk to another app

I advise you to create the app that you want it to contain theses knowledges objects using a customize app template. In this case choose search app like your app template

In splunk web go to "$SPLUNK_HOME/etc/apps/" folder , copy search app directory and paste it in "$SPLUNK_HOME/share/splunk/app_templates" folder .

After doing this restart splunkweb .
For creating of your app go to Apps > Manage Apps > create app . In the Add new panel you will see in drop down Template search app template. just select it and continuous to fill the fields.

Restart splunkweb

After all these steps will see all knowledges objects of search app in your new app.

For more information about app configurations see Splunk-6.1.1-Developing Views and Apps for Splunk Web

[masonmorales]

Yes. Stop Splunk first. Make a backup copy of the $SPLUNK_HOME/etc/apps folder and $SPLUNK_HOME/etc/users/ folder. You can then move shared knowledge objects out of $SPLUNK_HOME/etc/apps/search to other apps, using the same directory structure. For example, views under $SPLUNK_HOME/etc/apps/search/local/data/ui/views can be moved to $SPLUNK_HOME/etc/apps/YOURAPP/local/data/ui/views.

For objects that are not shared, the path is slightly different. For example, user "mason" may have private knowledge objects in the "search" app, which would be stored under $SPLUNK_HOME/etc/users/mason/search/local/data/ui/views. You will also find savedsearches.conf and the like in those directories. Just move them to your desired directories.

If you have a lot of objects, the easiest thing to do would be to share everything so that it's moved to the app's local folder (instead of the users' folders), and then move objects to other app folders as desired.

Once complete, start Splunk and you should be golden.

[fab73]

Is there another way to share a Data Model/Pivot/Dashboard/View etc between Search and Report app and another custom app? I tried with permissions at all levels on all item of the data and presentation chain, without results. Custom app doesn't see objects created in Search app.

My question is there is any other way by console other than moveing manually data and folders?

[nwales]

That makes sense, I have thousands of objects and they will be going into different new apps depending on the context so I can't make sweeping changes. Weeding through each file and presumably the metadata seems sluggish.

If I could do an API call to get the search, download it, POST it to the new app and delete the original that would probably be easier in the long run.