Moving searches from default to local to be able to manage on the cluster

[skirven]

Hi! I am trying to deal with some technical debt, and I thought I had an understanding of what I needed. 😞 

Objective: I have some search artifacts inside a custom app on my Search Head Deployer that once deployed, users are unable to delete. On the Deployer, those searches were in the Default folder. I did give this what I thought was a thorough reading https://docs.splunk.com/Documentation/Splunk/7.2.10/DistSearch/PropagateSHCconfigurationchanges, but I may have missed something.

What I tried:
1) Backup the app
2) Moved the contents on the Deployer Server of shcluster/apps/app_name/default/savedsearches.conf to local/savedsearches.conf
3) I updated the local/app.conf to a "deployer_push_mode = full".

What appeared to happen: It seems that it may have merged the deployer local folder into the default on the cluster, which may make sense after another spin through the document.

What's the best approach for cleaning up this app? Should I just deploy it to  my Search Head Deployer as an app, then remove the searches I want to clean up, then redeploy to the cluster?

Thanks!
Stephen

[thambisetty]

I believe you are looking something similar to below thread:

https://community.splunk.com/t5/Deployment-Architecture/Savedsearches-in-search-app-migrating-to-SHC...

[skirven]

Thanks for the response. But I already have the app created on the Deployer Server. It's moving the searches inside the app to be able to manage them. I don't want to go through and have to make a new app. 😞

Thanks!
Stephen