Export saved (and scheduled) searches. Possible?

[gfoligna0]

Hello everyone,

I'm working with Splunk and Nagios integrated (at Zappos), and we just changed our approach to monitor an application.
We have set up almost 70 scheduled searches but we need to disable, and then erase, all of them, but we don't need to lose those. So, I'm wondering if there's any chance that Scheduled Searches, and Saved Searches, could be exported from their .conf or wherever they are stored in order to add them back to Splunk in a near (or not that near) future.



I'll appreciate any input on this.

Thank you for you time. Cheers.

Gonzalo Foligna

Level 1 Operations Support - www.edrans.com

London: +44 20 3318 1571 | Buenos Aires: +54 11 5368 5839 - Ext. 8014

[Ayn · Accepted solution]

All saved searches including their scheduling (if any), name, search parameters etc reside in savedsearches.conf. Create backups of these files and you will have effectively created backups of the saved searches themselves.

NOTE that, as you may know, like pretty much any Splunk configuration file savedsearches.conf can reside in multiple locations, so make sure you look in all the right places (for instance $SPLUNK_HOME/etc/apps/<yourApp>/local/savedsearches.conf would be likely if the saved searches reside inside a specific app).

[gfoligna0]

It works perfectly!

Thank you!

[gfoligna0]

Thanks! I'll check that and get back to you.