Splunk Search

How to share and manage searches across Splunk instances?

dougmartin
Path Finder

We have multiple Splunk instances (webui & indexer) that we manage. They're currently kept isolated by design. However, we're trying to figure out the best way to share searches and distribute searches between the instances with minimal effort.

Basically, we want to create a search/report on SplunkB and see it on SplunkA & SplunkC within a short time frame (0-15minutes would suffice). We'd also like the searches from SplunkA to show up on B&C.

Hopefully that makes sense.

0 Karma

woodcock
Esteemed Legend

Probably the easiest way is to make sure that everybody savers the searches, then upgrades the permissions of the saved searches to "app" so that each set of associated searches/alerts/KOs is contained inside specific apps. Then use this app to export the entire mess as a single zip file that can be installed on the other search head:

https://splunkbase.splunk.com/app/2613/

The only real downside is that this is a 1-way sync, not a 2-way, but I am assuming that you are talking about Dev->Production.

dougmartin
Path Finder

Yup, the 1-way sync would be a start.
A little worried about overwriting saved searches but something has to give since there is no great way to do this otherwise.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!