Deployment Architecture

Can you help me with a Splunk Backup Question?

johann2017
Explorer

I am running Splunk Enterprise version 6.6.2. I have four Splunk servers in a non-clustered environment: One search head, one heavy forwarder, one deployment server, and one indexer. In the scenario of an unrecoverable server crash, what files need to be backed up to rebuild Splunk on a new server?

Currently I am backing up everything in these two directories: /opt/splunk/etc and /opt/splunk/var

0 Karma

adonio
Ultra Champion

considering you are using default locations for indexers and apps.
on the indexers, backup splunk/etc/ (configurations) and splunk/var (indexed data and other stuff)
on the rest of the instances, splunk/etc/ is enough

i would recommend to look into splunk diag, to make your backup and recovery easier.
read here: https://docs.splunk.com/Documentation/Splunk/7.2.4/Troubleshooting/Generateadiag

hope it helps

johann2017
Explorer

So running a diag on each of my Splunk servers will assist in a backup / recovery process? For this, should I disable dispatch, disable pool, and .dat files? Or include everything?

0 Karma

adonio
Ultra Champion

diag will simplify your backup process
on the indexers, youll probably want to backup the data too.
https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Backupindexeddata#Choose_your_backup_stra...

another elaborated answer here:
https://answers.splunk.com/answers/469816/what-is-the-best-practice-to-backup-splunk.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...