Splunk Search

Is it the best practice to import savedsearches.conf across multiple Splunk instances?

chitralekha
New Member

Hi All,

I am new to Splunk and was looking for tutorials regarding Searching and Reporting on Splunk.

My question here is when we write Splunk queries and save those reports it gets saved to savedsearches.conf file. For my continuous deployment across different environments (dev,qa), we need a mechanism to import and run these queries on different Splunk instances.

Did some searching and found I could import/copy these savedsearches.conf to different instances and can see the reports/alerts created on host one is also coming up on host 2. Just want to know if this would be correct process to import all configuration across multiple Splunk servers?

Do any other processes need to be met for the above requirement? Please share the documentation, if so.

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

The closest article I can find to this is Migrate from a standalone search head to a search head cluster

I would keep in mind that anything private is going under the etc/users directory, anything shared is under the etc/apps/ directory.
The metadata is also important in addition to the savedsearches.conf depending on what export settings you intend to use, I have moved searches around before and lost the owner/permissions on them by not including the metadata file...these are metdata/local.meta and metadata/default.meta in the relevant app directory...

View solution in original post

0 Karma

gjanders
SplunkTrust
SplunkTrust

The closest article I can find to this is Migrate from a standalone search head to a search head cluster

I would keep in mind that anything private is going under the etc/users directory, anything shared is under the etc/apps/ directory.
The metadata is also important in addition to the savedsearches.conf depending on what export settings you intend to use, I have moved searches around before and lost the owner/permissions on them by not including the metadata file...these are metdata/local.meta and metadata/default.meta in the relevant app directory...

0 Karma

chitralekha
New Member

thanks for mentioning about the meta data. So If we are saving any thing with app permission we should keep in mind migrating all the configuration present in $splunk_home/etc/apps/

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>