Splunk Search

Merging local into default using git?

dominiquevocat
SplunkTrust
SplunkTrust

I would like to periodically merge stuff in /local into /default and then delete whatever is in /local
I have a repository per app and a remote git server
I think it should be possible to merge these two subfolders with /local winning over /default but i am severely lacking in git knowledge so please be gentle 🙂

clarification:
The idea is to merge UI generated changes back into default (on INTG), push it to the central git and then pull the repo version to a splunk PROD stage ( /etc/apps or /etc/deployment-apps or /etc/cluster-apps or whatever was the path again).

Mostly for app maintainers updating searches and knowledge objects on the GUI with no shell access.

Tags (2)
1 Solution

dominiquevocat
SplunkTrust
SplunkTrust

If you face the same issue just use the new custom command mergeapp in https://splunkbase.splunk.com/app/3685/

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You could run on SH's command line 

/opt/splunk/bin/splunk package app <app name>

to merge and export app. 

BTrust
Path Finder

Hi @isoutamo ,

Yes, I'm fully aware if this solution, and would also use it, if I had physical access to the box, but I don't.
But I do have REST access, why I'm looking for a rest solution 👍

PS. The deprecated REST package app still works, there is just no link to get the SPL file anymore.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

It makes sense, I'm just not aware of something apart from the package endpoint that has the local-to-default merge logic already built.

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

ok, so i ended up doing my custom command and its up for grabs at https://splunkbase.splunk.com/app/3685/

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I don't see why not. Package app, put content of .spl wherever you commit to git from, commit to git.

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

hm, yeah kinda look ok-ish. The idea was to work with a repository equaling an app and work directly with it in /etc/apps for instance.

The general workflow is supposed to be
1. fork app from template in bitbucket
2. clone repo into /etc/apps (or /etc/deployment-apps or /etc/master-apps) on a development stage
3. edit the app, in the case of an ui app via splunk web-ui (power users)
4. merge changes, clean stuff in local
5. push changes into git
6. clone or update app into a production stage into the apropriate structure and refresh leading to usable app in ui or app being deployed via cluster or deployment method

we keep a separate gitdir so there is no git cluter in the repo itself.

Do i make sense?

I guess i can do what you suggest and take the "detour" via /package of which i was not aware

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

ok, but this won't touch the app itself so i can not work with git directly etc.

0 Karma

DMohn
Motivator

It is generally not recommended to have your local changes in the default folder, as any App Update will break your individual settings.

Are there any special reasons for you to not keep the local configs?

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

The idea is to merge UI generated changes back into default (on INTG), push it to the central git and then pull the repo version to a splunk PROD stage ( /etc/apps or /etc/deployment-apps or /etc/cluster-apps or whatever was the path again).

Mostly for app maintainers updating searches and knowledge objects on the GUI with no shell access.

I will update the question to clarify

0 Karma

koshyk
Super Champion

hi mate, why you merge into "default" ? Better to keep within "local" of your app.
You doing this for SH cluster?

Also the merging shouldn't be done using git, but you should look into btool

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

open for pointers

essentially i want to merge all changes by non admins with shell and vi 🙂 into the default

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...