Automate Splunk configuration files backup on day basis

[splunkwar]

Hi,

I'd like to automate Splunk config files backup process for every 24 hours.

Is there any Apps/Scripts available to achieve the same.

Many thanks.

[manjunathmeti · Accepted solution]

You can compress $SPLUNK_HOME/etc/ and keep backup of compressed file. A simple shell script can do this and you can schedule it for every 24 hours using cron.

/backup.sh

#!/bin/bash
TIME=`date +%b-%d-%y`                      # This Command will read the date.
FILENAME=splunk-configs-backup-$TIME.tar.gz    # The filename including the date.
SRCDIR=/opt/splunk/etc                       # Source backup folder.
DESDIR=/backup                                    # Destination of backup file.
tar -cpzf $DESDIR/$FILENAME $SRCDIR

Cron expression:

00 04 * * * /bin/bash /backup.sh

This will run the script every day at 04:00:00.

[SamHTexas]

Which Splunk Server do I run this script, where should be the place / path for this script to run ?

[SamHTexas]

How do I add the cron expression to the stanza please for it to run every 24 hours on weekends for examples. Thank u

[splunkwar]

Hi, Thanks for the answer.
I have python script, which will do the same. could you please tell me , where should I add this script (directory) & how would I schedule to run for every 24 hours ?
Thanks in advance!

[manjunathmeti]

You can copy this script on /opt/splunk/bin/scripts and make it executable and add cron expression in crontab.

# chmod +x /opt/splunk/bin/scripts/test.py
# crontab -e

0 0 * * * /usr/bin/python /opt/splunk/bin/scripts/test.py

Save it. This will trigger this script everyday at midnight.

[splunkwar]

Thanks a lot 🙂