Splunk Search

Is it the best practice to import savedsearches.conf across multiple Splunk instances?

chitralekha
New Member

Hi All,

I am new to Splunk and was looking for tutorials regarding Searching and Reporting on Splunk.

My question here is when we write Splunk queries and save those reports it gets saved to savedsearches.conf file. For my continuous deployment across different environments (dev,qa), we need a mechanism to import and run these queries on different Splunk instances.

Did some searching and found I could import/copy these savedsearches.conf to different instances and can see the reports/alerts created on host one is also coming up on host 2. Just want to know if this would be correct process to import all configuration across multiple Splunk servers?

Do any other processes need to be met for the above requirement? Please share the documentation, if so.

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

The closest article I can find to this is Migrate from a standalone search head to a search head cluster

I would keep in mind that anything private is going under the etc/users directory, anything shared is under the etc/apps/ directory.
The metadata is also important in addition to the savedsearches.conf depending on what export settings you intend to use, I have moved searches around before and lost the owner/permissions on them by not including the metadata file...these are metdata/local.meta and metadata/default.meta in the relevant app directory...

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/

View solution in original post

0 Karma

gjanders
SplunkTrust
SplunkTrust

The closest article I can find to this is Migrate from a standalone search head to a search head cluster

I would keep in mind that anything private is going under the etc/users directory, anything shared is under the etc/apps/ directory.
The metadata is also important in addition to the savedsearches.conf depending on what export settings you intend to use, I have moved searches around before and lost the owner/permissions on them by not including the metadata file...these are metdata/local.meta and metadata/default.meta in the relevant app directory...

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/

View solution in original post

0 Karma

chitralekha
New Member

thanks for mentioning about the meta data. So If we are saving any thing with app permission we should keep in mind migrating all the configuration present in $splunk_home/etc/apps/

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!