Deployment Architecture

VersionControl for Splunk - Disaster Recovery Strategy for Splunk KO's and conf files

adnankhan5133
Communicator

Does anyone have any experience with the VersionControl for Splunk App? Planning to use this for backup/restore of Splunk conf files and knowledge objects (DR strategy)

I’m planning to come up with a strategy for backing up and restoring the knowledge objects (i.e. dashboards, reports, alerts, saved searches) and configuration files associated to Splunk ES and the various apps/add-ons that shall be part of the deployment at our organization. This is mainly to ensure that all of our Splunk items are capable of being restored to our Disaster Recovery site in the event that Production experiences prolonged downtime. Our Splunk search heads and Management consoles (Deployment Server, Index Cluster Master) in DR shall be on cold standby and unavailable, unless we need to start them up if a disaster occurs.

Would anyone know if the VersionControl for Splunk App ( https://splunkbase.splunk.com/app/4355/#/details ) is any good? As long as I'm able to backup my Splunk conf files and KO's from Production, and restore these to my DR site in the event of a disaster/prolonged Production downtime, then I'm comfortable with leveraging this app as a DR strategy. I'm less concerned about version control since we'll only have 4 people managing our Splunk ES deployment and we won't have thousands of KO's to take care of here.

0 Karma

gjanders
SplunkTrust
SplunkTrust

The Splunk app for version control was built to allow a user-level restore of knowledge objects

If your goal is to restore a server in a DR environment you could consider a simpler approach such as "Git Version Control for Splunk"

If you want anyone to be able to restore a single knowledge object than the Splunk app for version control is a better choice...the git version control for Splunk would likely involve restoring config files to the filesystem and a restart...

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...