export/import Splunk Project

[otman01]

Hi, I’m a student and my intership project is focused on splunk to collect data ana make some analyses an some repports.

Now I want to export an old projet from splunk server, and import it in an other ionstance of splunk. other way , I have two instances for Splunk the first for testing environement and the seconde is for product environement, and I want to clone all the application that was already developped in the testing environement and make it it turn in product environement.

I maked some searchs in Internet but I didn’t fine something that explain clearly how to process. If you have somme ideas, Thank you for answering . ( sorry my English is not very well 🙂 )

Best regards.

[otman01]

I'm from France.

[otman01]

Gyslainlatsa , Schose,
Thank you for your answers , it works 🙂 .
Have a nice day

[gyslainlatsa]

hi otman01,
I'm glad you were able to solve your problem.
good day to you? I am from Cameroon.

[otman01]

I'm from France. 🙂

[schose]

Hi,

your "project" consists of multiple parts.

1. App (This are the Dashboards, information about you data, lookup, data inputs etc). You can just copy the app from one server from $SPLUNK_HOME/etc/apps/myapp to another server to $SPLUNK_HOME/etc/apps/myapp
2. Your data - your data is organized in indexes - typically found within $SPLUNK_HOME/var/lib/splunk/indexname . if you want the same data like on your original system you need to copy the data by copy the index or export/import the data. If possible i suggest you to copy the index.

Regards

Andreas

[gyslainlatsa · Accepted solution]

hi otman01,
I do not know if this will help you.
splunk to export a project and use it in another instance splunk, you must export it as an application .zip positioning itself in the directory $splunk_home/etc/apps and reinstall it in the other instance splunk like you have the usually install applications.
if you are on windows, preferably to export with the administrator account to avoid data loss.

please forgive my english.