Migrate KO (Reports/Alerts/Dashboards) from Splunk On-Prem to Splunk Cloud

[arpantfs]

We're migrating the Splunk from On-Premise environment to Cloud, and are done with setting up forwarders to send the data to Splunk Cloud. However, we have a large number of alerts, reports and dashboards created on Splunk On-Premise.

Is there a way to transfer these (alerts, reports, and dashboards) from Splunk On-Premise to Splunk Cloud? 

Thanks.

[gjanders]

The transferknowledgeobjects script I wrote may help https://github.com/gjanders/Splunk/ or https://github.com/gjanders/Splunk/blob/master/bin/transfersplunkknowledgeobjects.py for a direct link

[Roy_9]

@arpantfs there isn't an article for this i guess, you need to manually build it and you could use splunk add-on builder for this.

[Roy_9]

@arpantfs Hello,

you could package these ko's in to an custom app and upload it into Splunk cloud.

Note:this app should pass the splunk app inspect when you are uploading it to cloud.

thanks

[arpantfs]

Thank you @Roy_9 for the response ! would you know of any article or steps that can help in the creation of a custom app containing alerts, reports and dashboards !

All your responses are greatly appreciated - thank you !