Splunk Search

Merging local into default using git?

dominiquevocat
SplunkTrust
SplunkTrust

I would like to periodically merge stuff in /local into /default and then delete whatever is in /local
I have a repository per app and a remote git server
I think it should be possible to merge these two subfolders with /local winning over /default but i am severely lacking in git knowledge so please be gentle 🙂

clarification:
The idea is to merge UI generated changes back into default (on INTG), push it to the central git and then pull the repo version to a splunk PROD stage ( /etc/apps or /etc/deployment-apps or /etc/cluster-apps or whatever was the path again).

Mostly for app maintainers updating searches and knowledge objects on the GUI with no shell access.

Tags (2)
1 Solution

dominiquevocat
SplunkTrust
SplunkTrust

If you face the same issue just use the new custom command mergeapp in https://splunkbase.splunk.com/app/3685/

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You could run on SH's command line 

/opt/splunk/bin/splunk package app <app name>

to merge and export app. 

BTrust
Path Finder

Hi @isoutamo ,

Yes, I'm fully aware if this solution, and would also use it, if I had physical access to the box, but I don't.
But I do have REST access, why I'm looking for a rest solution 👍

PS. The deprecated REST package app still works, there is just no link to get the SPL file anymore.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

It makes sense, I'm just not aware of something apart from the package endpoint that has the local-to-default merge logic already built.

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

ok, so i ended up doing my custom command and its up for grabs at https://splunkbase.splunk.com/app/3685/

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I don't see why not. Package app, put content of .spl wherever you commit to git from, commit to git.

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

hm, yeah kinda look ok-ish. The idea was to work with a repository equaling an app and work directly with it in /etc/apps for instance.

The general workflow is supposed to be
1. fork app from template in bitbucket
2. clone repo into /etc/apps (or /etc/deployment-apps or /etc/master-apps) on a development stage
3. edit the app, in the case of an ui app via splunk web-ui (power users)
4. merge changes, clean stuff in local
5. push changes into git
6. clone or update app into a production stage into the apropriate structure and refresh leading to usable app in ui or app being deployed via cluster or deployment method

we keep a separate gitdir so there is no git cluter in the repo itself.

Do i make sense?

I guess i can do what you suggest and take the "detour" via /package of which i was not aware

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

ok, but this won't touch the app itself so i can not work with git directly etc.

0 Karma

DMohn
Motivator

It is generally not recommended to have your local changes in the default folder, as any App Update will break your individual settings.

Are there any special reasons for you to not keep the local configs?

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

The idea is to merge UI generated changes back into default (on INTG), push it to the central git and then pull the repo version to a splunk PROD stage ( /etc/apps or /etc/deployment-apps or /etc/cluster-apps or whatever was the path again).

Mostly for app maintainers updating searches and knowledge objects on the GUI with no shell access.

I will update the question to clarify

0 Karma

koshyk
Super Champion

hi mate, why you merge into "default" ? Better to keep within "local" of your app.
You doing this for SH cluster?

Also the merging shouldn't be done using git, but you should look into btool

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

open for pointers

essentially i want to merge all changes by non admins with shell and vi 🙂 into the default

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...