Splunk reports dashboards Alerts path on indexer machine

[sanjubaba]

I have some dashboards,alerts,reports in my single instance environment which are created under search app. Where do I find configurations of all those dashboards,alerts,reports on indexer machine.

Please help me with the path of configuration.

[gcusello]

Hi @sanjubaba,

you have to create a new app and then move all the objects from Search to this new app.

For this reason it's a best practice never use search when you need to create any knowledge object (fields, eventtypes, dashboards, alerts, etc....

Anyway, you could move the knowledge objects also copying part of the conf files by file system, but I prefer to use GUI (it requires more time but it's more controlled and you dont need to restart Splunk):

• Report and Alerts [Settings -- Searches, Repoorts and alerts];
• Dashboards [Settings -- User Interface -- Vievs];
• Fields [Settings -- Fields];
• eventtypes [Settings -- Event types].

Ciao.

Giuseppe