Reporting

Migrating Saved Search from 3.x to 4.x

Simon
Contributor

Hi folks

Is there a way to manually migrate saved searches from splunk 3.x to 4.x? The problem is that I didn't upgrade my splunk instance but rather built a new splunk instance beside and let my forwarders send the data to both instances so I miss now my saved searches on the new splunk 4.x box.

Thanks for hints, Simon

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

In general, you should be able to just copy the 3.x saved search stanza from savedsearches.conf to a savedsearches.conf file in 4.x. Note however that in 4.x, savedsearches.conf can't sit in etc/system, and must be in an app and run in an app context. (Migration moves them to the search app.)

There are a couple of search syntax changes and a couple of search commands that may have changed, but the vast majority should work without change.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

In general, you should be able to just copy the 3.x saved search stanza from savedsearches.conf to a savedsearches.conf file in 4.x. Note however that in 4.x, savedsearches.conf can't sit in etc/system, and must be in an app and run in an app context. (Migration moves them to the search app.)

There are a couple of search syntax changes and a couple of search commands that may have changed, but the vast majority should work without change.

Simon
Contributor

Thanks, that's good to hear!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...