Reporting

How to export my custom TA to share with other Splunk instances?

DEAD_BEEF
Builder

I have a custom TA installed and was wondering what is the method to copy the entire thing and share it? I looked on the deployment server and it's listed there (but not in Apps) so I'm not sure how to go about exporting it. Do I just copy the TA's directory from the DS itself?

0 Karma
1 Solution

dflodstrom
Builder

You can just tar up the App/TA directory and install that (a .tar, .tar.gz, or .tgz should work just fine) or have a look at this answer for the Splunk command to create a .spl

splunk package app <appName>

https://answers.splunk.com/answers/109787/how-to-export-a-splunk-app-to-spl.html

View solution in original post

0 Karma

dflodstrom
Builder

You can just tar up the App/TA directory and install that (a .tar, .tar.gz, or .tgz should work just fine) or have a look at this answer for the Splunk command to create a .spl

splunk package app <appName>

https://answers.splunk.com/answers/109787/how-to-export-a-splunk-app-to-spl.html

0 Karma

DEAD_BEEF
Builder

Thank you, I thought it might be this straightforward but I wasn't sure and couldn't find anything stating such.

kthammireddy
New Member
  1. You can copy the TA's to $SPLUNK_HOME/etc/deployment-apps on your Deployment Server.
  2. Use forwarder management to deploy TA's to other splunk instances.
  3. This might be usefull link http://docs.splunk.com/Documentation/Splunk/7.1.0/Updating/Aboutdeploymentserver
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...