Deployment Architecture

How to backup Splunk for a non-clustered environment?

johannterc
New Member

Hello. I have seen several threads on backing up Splunk but see a lot of different answers so I am not 100% sure which method to follow. I have a relatively simple setup consisting of one Heavy Forwarder, indexer, search head, and deployment server. No clustering. Running Splunk Enterprise 6.5.1. If any of these four main forwarders were to crash completely, what files would I need backed up to restore things back to normal? I am not necessarily interested in restoring logs, mainly concerned with the configuration related files so I don't have to rebuild everything from scratch.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

For configurations, you should use the deployment server which deploys conf files to forwarder groups via the serverclass you define. If you lose a server that had a forwarder installed on it, you can simply install the forwarder again, add the client back to the DS, and redeploy via the DS. You may also have to add an ignoreolder than attribute so avoid re-indexing data.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...