Monitoring Splunk

Backup and restore of Splunk??

apro
Path Finder

Hi,

Been trying to backup and restore of Splunk indexer and the steps that I took to backup our splunk server is:

- stop Splunk svcs via ./splunk stop
- tar the whole folder of /opt/splunk into splunk_backup.gz
- start up splunk svcs again.

I tried to restore this backup on a fresh installation of Splunk on a secondary machine to test but keep encountering this issue..

After restoration and starting splunk services successfully,I tried to log in to splunkweb but it gives an error page.I've checked and notice splunkweb is running but splunkd has crashed..

Any help on the backup and restore process??

Thanks..

Tags (3)

Chris_R_
Splunk Employee
Splunk Employee
0 Karma

Lowell
Super Champion

If you are experiencing a crash you may want to contact splunk support. The backup and restore approach you used should work fine.

The first thing I would do is go to /opt/splunk/var/log/splunk/ and check out any crash* log files as well as any messages at the end of splunkd.log

BTW, did you restore to the path /opt/splunk as well? I'm assuming that you did, but if you didn't that could be your problem. Splunk has some configs that assume you aren't changing this.

I'm assuming that you also dealt with setting up the splunk users and all of that.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!