topic Re: Splunk Backup in Splunk Search

Splunk Backup

lohit — Wed, 30 Oct 2013 08:22:29 GMT

I am facing problems with restoring splunk.

I require the searches, indexed data and users created on one installation of splunk to reflect on a fresh installation of splunk.

The steps I followed are:

For restoring data, I copied “defaultdb” folder from Splunk/var/lib/splunk/defaultdb ; “search” folder from Splunk/etc/apps ; “users” folder from Splunk/etc after stopping the splunk services.
Then, after stopping the splunk services on the fresh installation, I replaced the existing “users” and “search” folders with the ones I had copied. But, the saved searches and users did not reflect in Splunk.
Also, when I replaced defaultdb (after stopping the splunk services) in the fresh installation, splunk did not start and it says that splunkd started and then stopped.

Let me know where am I making a mistake and how to correct it. I need it urgently.

Re: Splunk Backup

alacercogitatus — Wed, 30 Oct 2013 11:20:45 GMT

When I transfer copies of Splunk, I take entire backups of etc and var. Make sure they are the SAME version! I'm assuming a *nix system based on the direction of your slashes in the question.

So on your command line on the old system.

cd $SPLUNK_HOME tar cvfz splunk_backup.tgz etc var

On the new system:

cd $SPLUNK_HOME tar xvfz splunk_backup.tgz

And chose the option to overwrite everything if requested.

Re: Splunk Backup

lohit — Wed, 30 Oct 2013 13:05:15 GMT

Hi alacercogitatus,

Thanks for your reply.

I have splunk on windows and the Splunk was re-installed on the same machine. So I only have these 3 folders from the previous splunk instance now: defaultdb, search and users.

Please suggest how to get the indexed data into new installation.

Re: Splunk Backup

lukejadamec — Wed, 30 Oct 2013 13:34:55 GMT

You can copy the contents of defaultdb/db and defaultdb/colddb to the same location on the new install.
You need to make sure that there are no duplicate unique IDs or you will get an error when you restart Splunk. The unique ID is the last set of numbers of the db folders after the last underscore, and you can change them by hand to whatever you want, just make sure no two are the same.

Re: Splunk Backup

lohit — Thu, 31 Oct 2013 06:27:31 GMT

Thank you lukejadamec,
Changing the duplicate ids worked.I suppose this was the issue why splunk was giving error.

Re: Splunk Backup

mcronkrite — Sun, 29 Jun 2014 22:14:32 GMT

I think you should be able to exclude some directories. e.g.

$SPLUNK_HOME$/var/run/splunk/dispatch/ 
$SPLUNK_HOME$/var/run/searchpeers/

Re: Splunk Backup

SamHTexas — Sat, 17 Apr 2021 21:21:50 GMT

Would you please show. How I can perform incremental Splunk Ent backups on Daily or weekly basis for small recoveries? Is there an app or process to do regular backups for a distributed environments? Thank u