topic Re: Configuration Backup in Splunk Enterprise

Configuration Backup

shocko — Thu, 09 Dec 2021 09:06:06 GMT

I'm running Splunk Enterprise 8.0.5 on Windows 2016 and looking to upgrade to 8.2.3. We run the following:

2 indexers
1 Search head
1 Master Node [Cluster Master, Deployment Server and License Master]

We currently are only backing up the index files which is very risky so I need to get the configuration backed up as well. From reading the documents it seems that generally we only need to backup:

$SPLUNK_HOME/etc/

Is there any requirement to backup /var/ or any other folders though?

Re: Configuration Backup

isoutamo — Thu, 09 Dec 2021 09:12:26 GMT

Basically it should be enough that you are backing up SPLUNK_HOME/etc and SPLUNK_DB directory, even there are some other status files under SPLUNK_HOME/var. If you can do offline update then the easiest/safest way is to do full backup of SPLUNK_HOME and SPLUNK_DB dir for all those nodes. Then the possible rollback to the previous version will be easier.

BUT if you has started those nodes and realise later on that you must do a rollback then you will be lost events which has arrived after update.

r. Ismo

Re: Configuration Backup

shocko — Thu, 09 Dec 2021 15:57:18 GMT

Thanks for the update. What about the KV store? Does that not need to be backed up also ?

Re: Configuration Backup

isoutamo — Thu, 09 Dec 2021 21:39:47 GMT

If you are backing up var as offline then you have it. Otherwise you should do it manually.

Re: Configuration Backup

shocko — Thu, 09 Dec 2021 22:11:16 GMT

Thanks. I'm a little confused by the documentation on this regard. I don't see where it specifically references backing up /var/ but i see this which indicates to create a kvstore backup Back up and restore search head cluster settings - Splunk Documentation

Re: Configuration Backup

isoutamo — Thu, 09 Dec 2021 22:13:02 GMT

Sorry, I am meaning $SPLUNK_HOME/var not /var.

Re: Configuration Backup

shocko — Mon, 13 Dec 2021 09:05:59 GMT

Ah yes, makes sense now. Offline backup i.e. all services stopped so no need to run the KVStore online backup commands.