topic Re: What is the path to the etc folder on windows or Unix hosts. How do I copy the etc folder for backing up purposes? in Splunk Enterprise

What is the path to the etc folder on windows or Unix hosts. How do I copy the etc folder for backing up purposes?

SamHTexas — Sun, 18 Apr 2021 18:37:00 GMT

What is the path to the etc folder on windows or Unix hosts. How do I copy the etc folder for backing up purposes? Please show steps. Are there more to backup on the Splunk enterprise or ES for daily / weekly back ups?

Re: What is the path to the etc folder on windows or Unix hosts. How do I copy the etc folder for backing up purposes?

richgalloway — Sun, 18 Apr 2021 21:04:47 GMT

The path is $SPLUNK_HOME/etc, where $SPLUNK_HOME normally is /opt/splunk or \Program Files\Splunk.

How to copy the directory will vary based on the tools at your disposal, company policy, etc. so exact steps can't be shown. It could be as simple as creating a tarball, however.

tar -czf /tmp/splunk_etc_backup /opt/splunk/etc

Re: What is the path to the etc folder on windows or Unix hosts. How do I copy the etc folder for backing up purposes?

SamHTexas — Sun, 18 Apr 2021 21:13:45 GMT

Thank u sir for this. Are there any apps for such back ups? Also is the etc & the kvstore the only items to back up for basic backups? If yes, do I back up the etc & kvstore on each individual Splunk Ent. server? Thank u very much in advance.

Re: What is the path to the etc folder on windows or Unix hosts. How do I copy the etc folder for backing up purposes?

richgalloway — Mon, 19 Apr 2021 00:47:19 GMT

I'm not aware of apps for backing up Splunk, but there is at least one for backing up the KVStore in splunkbase.

Yes, backing up etc and kvstore is enough.

Re: What is the path to the etc folder on windows or Unix hosts. How do I copy the etc folder for backing up purposes?

SamHTexas — Thu, 22 Apr 2021 14:17:54 GMT

Thanks Rich. I appreciate your response as always. So does the etc & KVstore need to be backed up from each Splunk server? to perform a basic backup? What else would u do for back up going a step above the basic backup? Thax

Re: What is the path to the etc folder on windows or Unix hosts. How do I copy the etc folder for backing up purposes?

richgalloway — Thu, 22 Apr 2021 16:57:10 GMT

Yes, each Splunk instance must be backed up separately.

That's all I would do, but my failure tolerance is pretty high. I've been to sites where they've set up automatic commits to git for every config file and dashboard. It's cool and it did come in handy at least once, but that may be too much for most customers.