Export all alerts,reports and dashboards present in splunk UI

[vineela]

Hi All,

Actually in our splunk environment there is no test environment prior and now its present, So i need to replicate all the alerts,dashboards and reports present in production to test environment.
I didnt have access to backend environment of Splunk.
Is there any smarter way to do that instead of cloning each and every alert.
Waiting for response.

Thanks in Advance.

[richgalloway]

The easiest and perhaps smartest way is to copy $SPLUNK_HOME/etc from one environment to the other.  If you don't have access to the file system then try to find someone who does.

If that's not an option then consider using a backup app like https://splunkbase.splunk.com/app/5600.  It will handle alerts and reports, but probably won't do dashboards so you may have to copy them yourself.

[vineela]

I didnt have access to backend and cant do it and even i didnt have admin access to download base app.

can you suggest me the way or query to list out all the savedsearches from UI and check for cloning..whether its done or not.

There are 3 lower environments,how can we check whether the data is present for one app in all the environments,is there a way to check the same?


Thanks in Advance.

[somesoni2]

Someone from your team or company should've admin access. Its much easier to get the information through them. 

[richgalloway]

List out the savedsearches using REST.  What you will see may be limited by your role.  This is where having admin access would be a benefit.

| rest /servicesNS/-/-/saved/searches splunk_server=local

There is no setting that indicates a saved search is a clone.  The default name of a clone has "clone" in it, but is not a reliable indicator.  The best you can do is look for identical search strings.

| rest /servicesNS/-/-/saved/searches splunk_server=local
| fields title search
| stats dc(search) as searchCount by title
| where searchCount > 1
| table title

Comparing data for different environments does not have a Splunk solution.  You'll have to export the results from each environment and use other tools to compare them.