Splunk Packaging Toolkit versus CLI Package Command

[deangoris]

We moved from Splunk Enterprise to Splunk Cloud a few years ago.

To migrate all our objects we packaged all apps with the CLI package command and uploaded them to Splunk Cloud.

This command merges everything from the local to the default folder as stated here: Package apps | Documentation | Splunk Developer Program 

Unfortunately the consequence is that these objects are not editable via UI anymore. A number of changes don't apply, even though the UI doens't provide me an error. (e.g. re-assigning an orphaned search, or deleting an old object).

To work around this issue, we asked for an export of the app via Splunk Support (there is no way of doing this via API as far as I can find) so we could change the app. But if we change the app and repackage it, than all local objects again will move to the default folder, making our problem in the future even worse.

I always used the "package" CLI command which does this local to default folder merge.

Is the Packaging Toolkit working in the same way? I don't have experience with it. If it is able to keep objects in the local folder, than it might save us...

Any other idea to overcome this situation welcome as well...

Thanks!

[tej57]

Hello @deangoris,

The Splunk packaging toolkit will also work in the similar fashion. The packages created using the toolkit should not have the local folder within it. Otherwise it'll fail on the UI itself. The best way to deal with this situation is to have a Barebone app created from the UI and have all the KOs migrated to the custom private app. This way it helps modifying the objects from UI in future as well.

Thanks,
Tejas.

---

If the above solution helps, an upvote is appreciated..!!