topic Are there any automated scripts to back up the kvstore on each Splunk server as part of a basic back? Daily or weekly? in Splunk Enterprise

Are there any automated scripts to back up the kvstore on each Splunk server as part of a basic back? Daily or weekly?

SamHTexas — Fri, 23 Apr 2021 02:42:34 GMT

Are there any automated scripts to back up the kvstore on each Splunk server as part of a basic back? How often should I backup the Kvstores?

Also what do I need to backup in Splunk Enterprise Security please.

Re: Are there any automated scripts to back up the kvstore on each Splunk server as part of a basic back? Daily or weekl

isoutamo — Fri, 23 Apr 2021 05:57:59 GMT

We are using this https://splunkbase.splunk.com/app/5328/. Of course you can use that splunk backup kvstore from command line, but then you must add user + password somewhere in plain text, which is something that I don't like.

How often you should run this? That depends on how active your kvstore is and how long RPO is.

r. Ismo

Re: Are there any automated scripts to back up the kvstore on each Splunk server as part of a basic back? Daily or weekl

SamHTexas — Wed, 05 May 2021 03:07:30 GMT

Sir, which servers do have KVstores that are worth backing up using this tool & how often do I back the KVstores on the Splunk servers? Thank u in advance.

Re: Are there any automated scripts to back up the kvstore on each Splunk server as part of a basic back? Daily or weekl

ragedsparrow — Wed, 05 May 2021 04:33:32 GMT

This isn't really a question that anyone can answer for you. This is basically something that you need to answer yourself. I'd base the frequency based on how much data in the kvstore(s) you can lose in the instance of a failure, as well as the storage that you're willing to use for backups.

Re: Are there any automated scripts to back up the kvstore on each Splunk server as part of a basic back? Daily or weekl

SamHTexas — Wed, 05 May 2021 13:26:26 GMT

Thank u for your message. I know KVstores are specific for Ent. Security app. but are there other KVstores on other Splunk servers worth backing up ? Which ones please. Thank u sir.

Re: Are there any automated scripts to back up the kvstore on each Splunk server as part of a basic back? Daily or weekl

isoutamo — Fri, 07 May 2021 11:54:34 GMT

You must backup at least your SHC nodes. And also I propose to backup other SH nodes too.
Of course if you have kvstore in use on other nodes also, you should backup those too.

Re: Are there any automated scripts to back up the kvstore on each Splunk server as part of a basic back? Daily or weekl

SamHTexas — Fri, 07 May 2021 13:39:19 GMT

Thank u sir as always for your expert help. One more question. Should I be installing the app # 5328 on each server individually to back up the KVstores please? Thank u

Re: Are there any automated scripts to back up the kvstore on each Splunk server as part of a basic back? Daily or weekl

isoutamo — Fri, 07 May 2021 17:20:55 GMT

Yes you should.