How do I backup the Splunk Enterprise Security app. What components needs to be backed up and how often?

SamHTexas — Sun, 09 May 2021 00:55:42 GMT

How do I backup the Splunk Enterprise Security app. What components needs to be backed up and how often? I have already documented a short plan to backup the Splunk Enterprise.

Re: How do I backup the Splunk Enterprise Security app. What components needs to be backed up and how often?

lkutch_splunk — Tue, 11 May 2021 17:33:11 GMT

Is it in a search head cluster environment?

https://docs.splunk.com/Documentation/ES/6.5.1/Install/InstallEnterpriseSecuritySHC#Back_up_and_restore_Splunk_Enterprise_Security_in_a_search_head_cluster_environment

https://docs.splunk.com/Documentation/ES/6.5.1/Install/InstallEnterpriseSecuritySHC#Restore_incident_review_history_from_internal_audit_logs

Also though, backing up theKV store is part of Enterprise:

https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/BackupKVstore
but should be done prior to upgrading ES:
https://docs.splunk.com/Documentation/ES/6.5.1/Install/Upgradetonewerversion

topic How do I backup the Splunk Enterprise Security app. What components needs to be backed up and how often? in Splunk Enterprise Security

How do I backup the Splunk Enterprise Security app. What components needs to be backed up and how often?

Re: How do I backup the Splunk Enterprise Security app. What components needs to be backed up and how often?