Reporting

How to clone reports from Splunk Ent to ES ( Ent. Security)? Thank u in advance

SamHTexas
Builder

How to clone reports from Splunk Ent to ES ( Ent. Security)?

Labels (1)
Tags (1)
0 Karma

rupkumar4sec
Path Finder

If you have ES on the same search head where the reports are located, You can just use Edit>Move from UI. 

If you they are on different search head or you have large number of reports that you want to migrate, You can Copy their definition from savedsearches.conf(From where it is defined now) and paste it in local/savedsearches.conf in ES app. 

0 Karma

SamHTexas
Builder

Thank u for your message. I just found it. Splunk Ent. & ES are not on the same SH. How do I clone it now please. Thank u in advance?

Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

The transfer knowledge object scripts might work for this https://github.com/gjanders/Splunk

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.