Deployment Architecture

Script to backup of Splunk

krissid
Engager

Does anyone have an example of a backup script for Splunk

Tags (1)
1 Solution

hedgehog
Explorer

Hi

This will need some tweeking, but here we go:

#!/bin/bash
SPLUNK="/opt/splunk"
CONFIG="/opt/splunk/etc"
BUCKETS="/opt/splunk/var/lib/splunk/"
ADMU={admin-user-name}
ADMP={admin-password}
INDEX={index you need to roll}
SPLUNK_HOME="/opt/splunk"
SPLUNK_DB="/opt/splunk/var/lib/splunk"

mount /mnt/backup
set $(date)

for i in ls /opt/splunk/var/lib/splunk ; do $SPLUNK_HOME/bin/splunk _internal call $SPLUNK_DB/roll-hot-buckets –auth $ADMU:$ADMP ; done

if test "$1" = "Sun" ; then
# weekly a full backup of all data and config. settings:
#
tar cfz "/backup/data/data_full_$6-$2-$3.tgz" $BUCKETS –-exclude='hot_' ; done
rm -f /backup/data/data_diff*
#
tar cfz "/backup/config/config_full_$6-$2-$3.tgz" $CONFIG
rm -f /backup/config/config_diff*
else
# incremental backup:
#
find $BUCKETS -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/data/data_diff_$6-$2-$3.tgz" "$LIST" –-exclude='hot_' ; done
rm -f "$LIST"
#
find $CONFIG -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/config/config_diff_$6-$2-$3.tgz" "$LIST"
rm -f "$LIST"
fi

View solution in original post

hedgehog
Explorer

Hi

This will need some tweeking, but here we go:

#!/bin/bash
SPLUNK="/opt/splunk"
CONFIG="/opt/splunk/etc"
BUCKETS="/opt/splunk/var/lib/splunk/"
ADMU={admin-user-name}
ADMP={admin-password}
INDEX={index you need to roll}
SPLUNK_HOME="/opt/splunk"
SPLUNK_DB="/opt/splunk/var/lib/splunk"

mount /mnt/backup
set $(date)

for i in ls /opt/splunk/var/lib/splunk ; do $SPLUNK_HOME/bin/splunk _internal call $SPLUNK_DB/roll-hot-buckets –auth $ADMU:$ADMP ; done

if test "$1" = "Sun" ; then
# weekly a full backup of all data and config. settings:
#
tar cfz "/backup/data/data_full_$6-$2-$3.tgz" $BUCKETS –-exclude='hot_' ; done
rm -f /backup/data/data_diff*
#
tar cfz "/backup/config/config_full_$6-$2-$3.tgz" $CONFIG
rm -f /backup/config/config_diff*
else
# incremental backup:
#
find $BUCKETS -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/data/data_diff_$6-$2-$3.tgz" "$LIST" –-exclude='hot_' ; done
rm -f "$LIST"
#
find $CONFIG -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/config/config_diff_$6-$2-$3.tgz" "$LIST"
rm -f "$LIST"
fi

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!