Can we save the extracted fields from one Splunk instance and import the same to another Splunk instance ?
Please let me know if the solution depends on license !
Extracted fields are pulled from props.conf
and transforms.conf
. So in theory and practice, you can transfer those files from one instance to another - no license impact at all. However, you have to make sure that ALL of the configurations are copied over from one to another. Install all the same apps, do diffs and rsyncs to transfer the files.
best is to package & deploy whole app.
Extracted fields are pulled from props.conf
and transforms.conf
. So in theory and practice, you can transfer those files from one instance to another - no license impact at all. However, you have to make sure that ALL of the configurations are copied over from one to another. Install all the same apps, do diffs and rsyncs to transfer the files.
Thank you.