What is the best method to sync production to dev environment? (Search Head Only)

[mburgess97]

I would like to sync my production search head to a development search head on a daily/weekly basis.  I need the same apps/configs on development server for testing before moving approved configs back into production.

Any tips on building a development search head and pulling in the production configs/apps?

[richgalloway]

Many customers sync their Dev and Prod instances via Git.  Searches are developed on the Dev instance and saved to Git once complete and tested  Then the searches are pushed to Prod from Git.  This approach requires no direct link between Dev and Prod, keeping the security team and auditors happy.  Git is the source of Truth with change/blame history.

[PickleRick]

This can be tricky. I'd try simply copying $SPLUNK_HOME/etc/apps $SPLUNK_HOME/etc/users and doing a dump/restore of kvstore. But you're gonna get into issues with some environment-specific settings. Like outputs.conf (if pushed via app) or roles/users configuration.