- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would like to export the Splunk for CEF configuration from one Splunk server, in order to import it to another Splunk.
I assume there is no way to export the config from the UI (please correct if it is wrong).
So I exported the all the files from the CLI /opt/splunk/etc/apps/splunk_app_cef/local
:
zip -r config-app-for-cef.zip /opt/splunk/etc/apps/splunk_app_cef/local/*
Then, to import it, I paste all these files into the same dir.
Is this a correct and recommended method of exporting/importing?
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![masonmorales masonmorales](https://community.splunk.com/legacyfs/online/avatars/198902.jpg)
I would suggest zip -r config-app-for-cef.zip /opt/splunk/etc/apps/splunk_app_cef/
If the app ships with default configurations, you won't have those if you only export the local folder. Zipping the entire $SPLUNK_HOME/etc/apps/MYAPP is the easiest manual way to copy app configurations over to another Splunk server.
Just make sure you restart Splunk on the target server in order for it to pickup the new app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![masonmorales masonmorales](https://community.splunk.com/legacyfs/online/avatars/198902.jpg)
I would suggest zip -r config-app-for-cef.zip /opt/splunk/etc/apps/splunk_app_cef/
If the app ships with default configurations, you won't have those if you only export the local folder. Zipping the entire $SPLUNK_HOME/etc/apps/MYAPP is the easiest manual way to copy app configurations over to another Splunk server.
Just make sure you restart Splunk on the target server in order for it to pickup the new app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![MuS MuS](https://community.splunk.com/legacyfs/online/avatars/2122.jpg)
Hi alexsuv,
this is a good approach as long as you have CLI access to the server.
If not, you can try this app https://splunkbase.splunk.com/app/2613/ made by @martin_mueller it works just fine and your app is packaged and ready as a spl
file.
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Grabbing the App Exporter linked above will let you do things through the UI entirely, assuming you can access your management port.
Do note, all approaches only copy settings shared within the app or globally, private settings won't be copied.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you 🙂
![](/skins/images/89D5ADE867CBAF0B5A525B7E23D83D7E/responsive_peak/images/icon_anonymous_message.png)