When I create a saved search through the web UI on a SH, it's replicated to other members in the cluster.
But if I create or modify a saved search directly in the config file (vi $SPLUNK_HOME/etc/apps/search/local/savedsearches.conf),
the modification is not visible on any member, including the host on which we modify the conf file.
But I can find the right stanza with btool.
My goal is to migrate saved searches from the current standalone SH to the new cluster.
↧