Monitoring Splunk

Backup and restore of Splunk??

apro
Path Finder

Hi,

Been trying to backup and restore of Splunk indexer and the steps that I took to backup our splunk server is:

- stop Splunk svcs via ./splunk stop
- tar the whole folder of /opt/splunk into splunk_backup.gz
- start up splunk svcs again.

I tried to restore this backup on a fresh installation of Splunk on a secondary machine to test but keep encountering this issue..

After restoration and starting splunk services successfully,I tried to log in to splunkweb but it gives an error page.I've checked and notice splunkweb is running but splunkd has crashed..

Any help on the backup and restore process??

Thanks..

Tags (3)

Chris_R_
Splunk Employee
Splunk Employee
0 Karma

Lowell
Super Champion

If you are experiencing a crash you may want to contact splunk support. The backup and restore approach you used should work fine.

The first thing I would do is go to /opt/splunk/var/log/splunk/ and check out any crash* log files as well as any messages at the end of splunkd.log

BTW, did you restore to the path /opt/splunk as well? I'm assuming that you did, but if you didn't that could be your problem. Splunk has some configs that assume you aren't changing this.

I'm assuming that you also dealt with setting up the splunk users and all of that.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...