We have Splunk v. 6.3.3 multi site indexer cluster (8 indexers), 4 search heads, deployment server.
What's the best approach to backup policy?
1. Should we backup $SPLUNK_HOME/etc directory on servers?
2. Will backing up of diag file be useful?
3. Any other advices?
Thank you in advance!
If the search heads are in a cluster,
- backup the deployer $SPLUNKHOME\etc\shcluster
- $SPLUNKHOME\etc of one the peers
- backup $SPLUNK_HOME\etc of all the search heads
Backup warm\cold\frozen buckets
Also backup cluster master - master apps.
Deployment (Forwarder deployment?):
Backup $SPLUNK_HOME\etc directory
I wouldn't backup diag file as it contains more than the needed files
Docs about backup:
Indexed data (bcukets) - http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Backupindexeddata
Configuration (etc) - http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Backupconfigurations
The main thing you want to backup is your hot/warm/cold/frozen db's which are under
SPLUNK_HOME/var/lib/splunk/defaultdb/colddb along with your configs under
Don't worry about backing up the diag's since it's just diagnostics on the current state of your system
How do you plan on backing this up? Are you running on a SAN? If so, do you plan on taking daily snapshots?