Reporting

How can I export/list out all reports in splunk

mkgoh
Engager

I would like to export my current existing reports / alerts for record and backup purpose, or maybe import to another new splunk system.

Tags (1)

lmyrefelt
Builder

You are better of collecting them in something that is called an "App".
This is easily done in the Splunk-UI, "Apps-menu > Manage Apps > Create APP" . Give it a fitting name.

From the app menu you should now be able to find / see your app, go there and do your work inside this. Or move the already created reports, views etc into this new app. This is also easily done from within the Splunk-UI and accessible from the "Settings" menu.
This also makes it very easy to share the contents and or setup more detailed permissions on your work.

It also makes it super easy to distribute and to install the same app / content on any number of Splunk servers ... and if you create something awesome you can upload and share it in apps.splunk.com .

Good reading for you;
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchTutorial/Aboutsavingandsharingreports

http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/CurateSplunkknowledgewithManager

As already stated you can use the different API:s to access and list this information, however if you collect your creations within an app , it will be easily sharable , easily accessible and you can tighten permissions, deploy to whatever number of splunk servers you like.

0 Karma

acharlieh
Influencer

All saved searches, and other knowledge objects are written to various .conf files in the $SPLUNK_HOME$/etc directory. This list of configuration files and Overview of configuration files may be of interest to you as a starting point.

Additionally there are some REST endpoints, such as /servicesNS/-/-/saved/searches, and /servicesNS/-/-/directory among others that you may be interested in invoking in a programmatic manner (or with the |rest command in splunkweb as well.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...