Hi @cogh3o
The easiest way for you to achieve this as a one-off is probably to pull the configs from the current On-Premise searchhead and build an app which you can upload to Splunk Cloud as a "private app" - this means it must pass AppInspect but not the full-blown checks that a Splunkbase app might need to pass in order to be uploaded.
The main things you will need to have is a valid app.conf, metadata files and no extras like .DS_Store / Thumbs.db files.
You can use SLIM packaging toolkit (https://dev.splunk.com/enterprise/docs/releaseapps/packageapps/packagingtoolkit/) to produce a tarball for your app once you have the files, then I would suggest running this through AppInspect locally to check for any issues before uploading.
There are some good docs over at https://docs.splunk.com/Documentation/SplunkCloud/9.3.2411/Admin/PrivateApps which guide you through the steps required.
Please dont hesitate to reach back out on this thread if you need any further help, or have any questions.
🌟 Did this answer help you? If so, please consider:
- Adding karma to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing
