Splunk Enterprise

How to export saved searches, reports and dashboard from Splunk Enterprise installed on Windows platform?

berzerk
Engager
 
Tags (1)
0 Karma

berzerk
Engager

Correct!

I need to export these saved searches, dashboards and reports to another instance of Splunk. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use zip or your favorite backup program to bundle-up %SPLUNK_HOME%\etc\apps\<app name> then copy the bundle to the other Splunk instance and un-bundle it.  "<app name>" refers to any app you installed on Splunk.  Do not copy built-in apps unless the two Splunk versions are identical.  You'll also want to copy %SPLUNK_HOME%\etc\apps\search\local\*.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please tell us more about what you wish to accomplish.  Export in what form?

Since Splunk is installed on Windows, I'll presume it's an on-prem installation.  That means the saved searches, report, and dashboards are all available in the file system.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...