topic Re: Splunk backup and restore in Splunk Enterprise

What is the correct method to backup/restore Splunk Enterprise?

SplunkNinja — Thu, 01 Dec 2022 16:28:17 GMT

What is the correct method to backup/restore Splunk Enterprise?

I believe I can backup (Linux) using this command:

tar czvf /opt/$HOSTNAME.tgz /opt/splunk/etc/

Re: Splunk backup and restore

richgalloway — Wed, 30 Nov 2022 19:56:58 GMT

It depends on what data you want to preserve, but that command should cover most scenarios.

Re: Splunk backup and restore

13tsavage — Wed, 30 Nov 2022 20:09:34 GMT

This is previously answered here: https://community.splunk.com/t5/Splunk-Enterprise/Configuration-Backup/m-p/577865

All of the ESSENTIAL configurations are found in $SPLUNK_HOME/etc/. In this hypothetical scenario, you would want to ensure this folder is captured. It includes the following:

- Splunk Enteprise License $SPLUNK_HOME/etc/licenses
- Splunk user knowledge objects $SPLUNK_HOME/etc/apps/<app_name>/local/*

What is NOT included in this backup and restore of $SPLUNK_HOME/etc/ is the indexed data as that is stored in $SPLUNK_HOME/var/lib/splunk/* (may be $SPLUNK_DB/)

So if you are asking to backup and restore a single instance of Splunk? You would want to ensure you include $SPLUNK_DB ($SPLUNK_HOME/var/lib/splunk/*

Re: Splunk backup and restore

SplunkNinja — Thu, 01 Dec 2022 21:04:03 GMT

Thanks 13tsavage

This is just a standalone SH. So, I believe I should be OK with archiving $SPLUNK_HOME/etc

Would this be a good command to be used to restore:

tar xzvf /opt/$HOSTNAME.tgz -C /opt/splunk/etc/

Re: Splunk backup and restore

13tsavage — Fri, 02 Dec 2022 15:31:46 GMT

Be careful with the command because if you have an archived folder of '/opt/splunk/etc/' in $HOSTNAME.tgz, you are telling your instance to place this directory in /opt/splunk/etc/. What this could do is place your 'etc' folder in the last directory you specify after -C, so the backup's 'etc/' folder would be placed in /opt/splunk/etc/etc <- here.

the following command should suffice:
tar -xzvf /opt/HOSTNAME.tgz -C /opt/splunk/

It is my recommendation to always run scenarios like this in your own test environment before trying to perform backup and and restores of production tools.

Re: What is the correct method to backup/restore Splunk Enterprise?

PickleRick — Fri, 02 Dec 2022 15:40:15 GMT

The process of backup/restore depends on what you need - do you need to back up only configuration or the data as well. If you want to back up everything, what is your RTO and RPO...

Re: Splunk backup and restore

SplunkNinja — Fri, 09 Dec 2022 20:59:47 GMT

Thanks 13tsavage.

I had to use this command to extract to /opt/splunk/etc:

tar -xzvf /opt/$HOSTNAME.tgz -C /

Re: What is the correct method to backup/restore Splunk Enterprise?

SplunkNinja — Fri, 09 Dec 2022 21:02:12 GMT

Hi PickleRick,

This is a lab/dev environment so we don't really have an RTO/RPO. It would be great if you could list some options. Thanks!

Re: What is the correct method to backup/restore Splunk Enterprise?

PickleRick — Sat, 17 Dec 2022 14:55:46 GMT

There is a more detailed description in the Admin Guide but in case of a lab environment (typically an all-in-one setup), the easiest things are to:

1) Copy the $SPLUNK_HOME/etc if you want to have just the configuration or

2) Stop the splunk daemon and copy the whole $SPLUNK_HOME if you want a full backup of all data.

Remember to restore to the same version!