Is it possible to import saved searches from 3.x splunk into 4.x splunk

[ebailey]

We have a large number of 3.x splunk saved searches that I need to import into our new splunk 4.x distributed search server. I see that the format of the saved searches are very different. Is this at all possible? I would like to avoid having to manually enter each saved search.

Thanks

Ed

[gkanapathy]

Actually, in most cases you can just copy the entire savedsearches.conf file. While 4.x changes settings names, the old ones are still recognized. A slightly more reliable way is to install 4.x over the 3.x instance and start it up, which will run the auto-migration that will update the files.

[gkanapathy]

There are in some places some syntax changes in some more obscure search commands, but those are rare.

[Jaci]

I found this other posting that might help answer your question. Unfortunately, there will be a little manual work involved.

http://answers.splunk.com/questions/1249/migrating-saved-search-from-3-x-to-4-x

There are also several pages of documentation that describes migrating saved searches on Splunk.com

http://www.splunk.com/base/Documentation/4.0.11/Installation/Whattoexpectwhenupgradingto4.0#What_you...

I hope that helps.