Monitoring Splunk

Backup and restore of Splunk??

apro
Path Finder

Hi,

Been trying to backup and restore of Splunk indexer and the steps that I took to backup our splunk server is:

- stop Splunk svcs via ./splunk stop
- tar the whole folder of /opt/splunk into splunk_backup.gz
- start up splunk svcs again.

I tried to restore this backup on a fresh installation of Splunk on a secondary machine to test but keep encountering this issue..

After restoration and starting splunk services successfully,I tried to log in to splunkweb but it gives an error page.I've checked and notice splunkweb is running but splunkd has crashed..

Any help on the backup and restore process??

Thanks..

Tags (3)

Chris_R_
Splunk Employee
Splunk Employee
0 Karma

Lowell
Super Champion

If you are experiencing a crash you may want to contact splunk support. The backup and restore approach you used should work fine.

The first thing I would do is go to /opt/splunk/var/log/splunk/ and check out any crash* log files as well as any messages at the end of splunkd.log

BTW, did you restore to the path /opt/splunk as well? I'm assuming that you did, but if you didn't that could be your problem. Splunk has some configs that assume you aren't changing this.

I'm assuming that you also dealt with setting up the splunk users and all of that.

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...