Script to backup of Splunk

[krissid]

Does anyone have an example of a backup script for Splunk

[hedgehog · Accepted solution]

Hi

This will need some tweeking, but here we go:

#!/bin/bash
SPLUNK="/opt/splunk"
CONFIG="/opt/splunk/etc"
BUCKETS="/opt/splunk/var/lib/splunk/"
ADMU={admin-user-name}
ADMP={admin-password}
INDEX={index you need to roll}
SPLUNK_HOME="/opt/splunk"
SPLUNK_DB="/opt/splunk/var/lib/splunk"

mount /mnt/backup
set $(date)

for i in ls /opt/splunk/var/lib/splunk ; do $SPLUNK_HOME/bin/splunk _internal call $SPLUNK_DB/roll-hot-buckets –auth $ADMU:$ADMP ; done

if test "$1" = "Sun" ; then
# weekly a full backup of all data and config. settings:
#
tar cfz "/backup/data/data_full_$6-$2-$3.tgz" $BUCKETS –-exclude='hot_' ; done
rm -f /backup/data/data_diff*
#
tar cfz "/backup/config/config_full_$6-$2-$3.tgz" $CONFIG
rm -f /backup/config/config_diff*
else
# incremental backup:
#
find $BUCKETS -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/data/data_diff_$6-$2-$3.tgz" "$LIST" –-exclude='hot_' ; done
rm -f "$LIST"
#
find $CONFIG -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/config/config_diff_$6-$2-$3.tgz" "$LIST"
rm -f "$LIST"
fi