Deployment Architecture

Do I have to backup $SPLUNK_HOME/var/run directory for a reliable backup?

damonmanni
Path Finder

When I make a backup of a splunk server every few days, I just usually tarball the whole /opt/splunk dir. This works fine for recovery purposes when I may need it.

But each backup is several GBs. So, I am looking for ways to trim down the backup copy while still retaining all I need for a 'full restore' of a server if every needed.

I notice that the ~/var/run/searchpeers has a lot of files + can be large in size. Can I skip this dir when I make my backup or is it crucial to the rebuild/restore?

cheers,
Damon

Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...