Is it the best practice to import savedsearches.conf across multiple Splunk instances?

[chitralekha]

Hi All,

I am new to Splunk and was looking for tutorials regarding Searching and Reporting on Splunk.

My question here is when we write Splunk queries and save those reports it gets saved to savedsearches.conf file. For my continuous deployment across different environments (dev,qa), we need a mechanism to import and run these queries on different Splunk instances.

Did some searching and found I could import/copy these savedsearches.conf to different instances and can see the reports/alerts created on host one is also coming up on host 2. Just want to know if this would be correct process to import all configuration across multiple Splunk servers?

Do any other processes need to be met for the above requirement? Please share the documentation, if so.

[gjanders · Accepted solution]

The closest article I can find to this is Migrate from a standalone search head to a search head cluster

I would keep in mind that anything private is going under the etc/users directory, anything shared is under the etc/apps/ directory.
The metadata is also important in addition to the savedsearches.conf depending on what export settings you intend to use, I have moved searches around before and lost the owner/permissions on them by not including the metadata file...these are metdata/local.meta and metadata/default.meta in the relevant app directory...

[chitralekha]

thanks for mentioning about the meta data. So If we are saving any thing with app permission we should keep in mind migrating all the configuration present in $splunk_home/etc/apps/