Deployment Architecture

Script to backup of Splunk

krissid
Engager

Does anyone have an example of a backup script for Splunk

Tags (1)
1 Solution

hedgehog
Explorer

Hi

This will need some tweeking, but here we go:

#!/bin/bash
SPLUNK="/opt/splunk"
CONFIG="/opt/splunk/etc"
BUCKETS="/opt/splunk/var/lib/splunk/"
ADMU={admin-user-name}
ADMP={admin-password}
INDEX={index you need to roll}
SPLUNK_HOME="/opt/splunk"
SPLUNK_DB="/opt/splunk/var/lib/splunk"

mount /mnt/backup
set $(date)

for i in ls /opt/splunk/var/lib/splunk ; do $SPLUNK_HOME/bin/splunk _internal call $SPLUNK_DB/roll-hot-buckets –auth $ADMU:$ADMP ; done

if test "$1" = "Sun" ; then
# weekly a full backup of all data and config. settings:
#
tar cfz "/backup/data/data_full_$6-$2-$3.tgz" $BUCKETS –-exclude='hot_' ; done
rm -f /backup/data/data_diff*
#
tar cfz "/backup/config/config_full_$6-$2-$3.tgz" $CONFIG
rm -f /backup/config/config_diff*
else
# incremental backup:
#
find $BUCKETS -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/data/data_diff_$6-$2-$3.tgz" "$LIST" –-exclude='hot_' ; done
rm -f "$LIST"
#
find $CONFIG -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/config/config_diff_$6-$2-$3.tgz" "$LIST"
rm -f "$LIST"
fi

View solution in original post

hedgehog
Explorer

Hi

This will need some tweeking, but here we go:

#!/bin/bash
SPLUNK="/opt/splunk"
CONFIG="/opt/splunk/etc"
BUCKETS="/opt/splunk/var/lib/splunk/"
ADMU={admin-user-name}
ADMP={admin-password}
INDEX={index you need to roll}
SPLUNK_HOME="/opt/splunk"
SPLUNK_DB="/opt/splunk/var/lib/splunk"

mount /mnt/backup
set $(date)

for i in ls /opt/splunk/var/lib/splunk ; do $SPLUNK_HOME/bin/splunk _internal call $SPLUNK_DB/roll-hot-buckets –auth $ADMU:$ADMP ; done

if test "$1" = "Sun" ; then
# weekly a full backup of all data and config. settings:
#
tar cfz "/backup/data/data_full_$6-$2-$3.tgz" $BUCKETS –-exclude='hot_' ; done
rm -f /backup/data/data_diff*
#
tar cfz "/backup/config/config_full_$6-$2-$3.tgz" $CONFIG
rm -f /backup/config/config_diff*
else
# incremental backup:
#
find $BUCKETS -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/data/data_diff_$6-$2-$3.tgz" "$LIST" –-exclude='hot_' ; done
rm -f "$LIST"
#
find $CONFIG -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/config/config_diff_$6-$2-$3.tgz" "$LIST"
rm -f "$LIST"
fi

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...