Reporting

How to export my custom TA to share with other Splunk instances?

DEAD_BEEF
Builder

I have a custom TA installed and was wondering what is the method to copy the entire thing and share it? I looked on the deployment server and it's listed there (but not in Apps) so I'm not sure how to go about exporting it. Do I just copy the TA's directory from the DS itself?

0 Karma
1 Solution

dflodstrom
Builder

You can just tar up the App/TA directory and install that (a .tar, .tar.gz, or .tgz should work just fine) or have a look at this answer for the Splunk command to create a .spl

splunk package app <appName>

https://answers.splunk.com/answers/109787/how-to-export-a-splunk-app-to-spl.html

View solution in original post

0 Karma

dflodstrom
Builder

You can just tar up the App/TA directory and install that (a .tar, .tar.gz, or .tgz should work just fine) or have a look at this answer for the Splunk command to create a .spl

splunk package app <appName>

https://answers.splunk.com/answers/109787/how-to-export-a-splunk-app-to-spl.html

0 Karma

DEAD_BEEF
Builder

Thank you, I thought it might be this straightforward but I wasn't sure and couldn't find anything stating such.

kthammireddy
New Member
  1. You can copy the TA's to $SPLUNK_HOME/etc/deployment-apps on your Deployment Server.
  2. Use forwarder management to deploy TA's to other splunk instances.
  3. This might be usefull link http://docs.splunk.com/Documentation/Splunk/7.1.0/Updating/Aboutdeploymentserver
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...