Deployment Architecture

Script to backup of Splunk

krissid
Engager

Does anyone have an example of a backup script for Splunk

Tags (1)
1 Solution

hedgehog
Explorer

Hi

This will need some tweeking, but here we go:

#!/bin/bash
SPLUNK="/opt/splunk"
CONFIG="/opt/splunk/etc"
BUCKETS="/opt/splunk/var/lib/splunk/"
ADMU={admin-user-name}
ADMP={admin-password}
INDEX={index you need to roll}
SPLUNK_HOME="/opt/splunk"
SPLUNK_DB="/opt/splunk/var/lib/splunk"

mount /mnt/backup
set $(date)

for i in ls /opt/splunk/var/lib/splunk ; do $SPLUNK_HOME/bin/splunk _internal call $SPLUNK_DB/roll-hot-buckets –auth $ADMU:$ADMP ; done

if test "$1" = "Sun" ; then
# weekly a full backup of all data and config. settings:
#
tar cfz "/backup/data/data_full_$6-$2-$3.tgz" $BUCKETS –-exclude='hot_' ; done
rm -f /backup/data/data_diff*
#
tar cfz "/backup/config/config_full_$6-$2-$3.tgz" $CONFIG
rm -f /backup/config/config_diff*
else
# incremental backup:
#
find $BUCKETS -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/data/data_diff_$6-$2-$3.tgz" "$LIST" –-exclude='hot_' ; done
rm -f "$LIST"
#
find $CONFIG -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/config/config_diff_$6-$2-$3.tgz" "$LIST"
rm -f "$LIST"
fi

View solution in original post

hedgehog
Explorer

Hi

This will need some tweeking, but here we go:

#!/bin/bash
SPLUNK="/opt/splunk"
CONFIG="/opt/splunk/etc"
BUCKETS="/opt/splunk/var/lib/splunk/"
ADMU={admin-user-name}
ADMP={admin-password}
INDEX={index you need to roll}
SPLUNK_HOME="/opt/splunk"
SPLUNK_DB="/opt/splunk/var/lib/splunk"

mount /mnt/backup
set $(date)

for i in ls /opt/splunk/var/lib/splunk ; do $SPLUNK_HOME/bin/splunk _internal call $SPLUNK_DB/roll-hot-buckets –auth $ADMU:$ADMP ; done

if test "$1" = "Sun" ; then
# weekly a full backup of all data and config. settings:
#
tar cfz "/backup/data/data_full_$6-$2-$3.tgz" $BUCKETS –-exclude='hot_' ; done
rm -f /backup/data/data_diff*
#
tar cfz "/backup/config/config_full_$6-$2-$3.tgz" $CONFIG
rm -f /backup/config/config_diff*
else
# incremental backup:
#
find $BUCKETS -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/data/data_diff_$6-$2-$3.tgz" "$LIST" –-exclude='hot_' ; done
rm -f "$LIST"
#
find $CONFIG -depth -type f ( -ctime -1 -o -mtime -1 ) -print > $LIST
tar cfzT "/backup/config/config_diff_$6-$2-$3.tgz" "$LIST"
rm -f "$LIST"
fi

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...