Splunk Search

Is it the best practice to import savedsearches.conf across multiple Splunk instances?

chitralekha
New Member

Hi All,

I am new to Splunk and was looking for tutorials regarding Searching and Reporting on Splunk.

My question here is when we write Splunk queries and save those reports it gets saved to savedsearches.conf file. For my continuous deployment across different environments (dev,qa), we need a mechanism to import and run these queries on different Splunk instances.

Did some searching and found I could import/copy these savedsearches.conf to different instances and can see the reports/alerts created on host one is also coming up on host 2. Just want to know if this would be correct process to import all configuration across multiple Splunk servers?

Do any other processes need to be met for the above requirement? Please share the documentation, if so.

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

The closest article I can find to this is Migrate from a standalone search head to a search head cluster

I would keep in mind that anything private is going under the etc/users directory, anything shared is under the etc/apps/ directory.
The metadata is also important in addition to the savedsearches.conf depending on what export settings you intend to use, I have moved searches around before and lost the owner/permissions on them by not including the metadata file...these are metdata/local.meta and metadata/default.meta in the relevant app directory...

View solution in original post

0 Karma

gjanders
SplunkTrust
SplunkTrust

The closest article I can find to this is Migrate from a standalone search head to a search head cluster

I would keep in mind that anything private is going under the etc/users directory, anything shared is under the etc/apps/ directory.
The metadata is also important in addition to the savedsearches.conf depending on what export settings you intend to use, I have moved searches around before and lost the owner/permissions on them by not including the metadata file...these are metdata/local.meta and metadata/default.meta in the relevant app directory...

0 Karma

chitralekha
New Member

thanks for mentioning about the meta data. So If we are saving any thing with app permission we should keep in mind migrating all the configuration present in $splunk_home/etc/apps/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...