|
We have a large number of 3.x splunk saved searches that I need to import into our new splunk 4.x distributed search server. I see that the format of the saved searches are very different. Is this at all possible? I would like to avoid having to manually enter each saved search. Thanks Ed |
|
Actually, in most cases you can just copy the entire savedsearches.conf file. While 4.x changes settings names, the old ones are still recognized. A slightly more reliable way is to install 4.x over the 3.x instance and start it up, which will run the auto-migration that will update the files. There are in some places some syntax changes in some more obscure search commands, but those are rare.
(15 Jun '10, 21:16)
gkanapathy ♦
|
|
I found this other posting that might help answer your question. Unfortunately, there will be a little manual work involved. http://answers.splunk.com/questions/1249/migrating-saved-search-from-3-x-to-4-x There are also several pages of documentation that describes migrating saved searches on Splunk.com I hope that helps. |
