Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Installation
- :
- Re: How to Backup Config Files
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to backup config files?
Him
What is the most convenient way to backup Splunk configuration file for different Splunk islands? We are migrating our customers to Splunk 8 and want to make sure that configuration is backed up periodically.
Can we use Splunk API for it?
Bests,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are several approaches you can use, but at the most basic level:
Take a copy of $SPLUNK_HOME/etc This will include all your system and application config files and any user data or private searches, and (importantly) the splunk.secret and passwd files.
If you have a copy of ./etc you should have everything you need to restore an instance (other than indexed data)
You can't use the Splunk Rest API to perform a backup per-se, but you can use it to list it and help you figure out what needs to be exported.
See here for a great presentation, demo and example code from .conf 19 https://conf.splunk.com/watch/conf-online.html?search=FN1315#/
Finally there are a number of applications on splunkbase (or you can implement your own) to check the contents of a single app (or all apps, or all of ./etc) into git - or another code repository if you choose.
(first two apps) https://splunkbase.splunk.com/apps/#/search/git%20version%20control/
This is a nice approach as it will give you versioned files so you can track (and revert) changes over time. Useful if you have lots of users creating/modifying assets, and want to keep that flexibility whilst introducing some safeguards.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the link to FN1315 doesn't work anymore
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
GitHub link should work. See previous message.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@nickhillscpl Thank you for the recognition on FN1315!
@gozdeyildiz: @dmarling and I put in a ton of work to develop that solution and share it with the Splunk community. The Cover Your Assets presentation explains the genesis, assumptions, gotchas, and does a working demo. After watching it, grab the code on Paychex's Github: https://github.com/paychex/Splunk.Conf19/
If there's questions/comments/etc., @ mention us here on Splunk Answers.
If this reply helps you, an upvote would be appreciated.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
