Can we save the extracted fields from one Splunk instance and import them to another Splunk instance?

[varunnair26]

Can we save the extracted fields from one Splunk instance and import the same to another Splunk instance ?

Please let me know if the solution depends on license !

[koshyk]

best is to package & deploy whole app.

[alacercogitatus · Accepted solution]

Extracted fields are pulled from props.conf and transforms.conf. So in theory and practice, you can transfer those files from one instance to another - no license impact at all. However, you have to make sure that ALL of the configurations are copied over from one to another. Install all the same apps, do diffs and rsyncs to transfer the files.

[varunnair26]

Thank you.