Backup and restore of Splunk??

[apro]

Hi,

Been trying to backup and restore of Splunk indexer and the steps that I took to backup our splunk server is:

- stop Splunk svcs via ./splunk stop
- tar the whole folder of /opt/splunk into splunk_backup.gz
- start up splunk svcs again.

I tried to restore this backup on a fresh installation of Splunk on a secondary machine to test but keep encountering this issue..

After restoration and starting splunk services successfully,I tried to log in to splunkweb but it gives an error page.I've checked and notice splunkweb is running but splunkd has crashed..

Any help on the backup and restore process??

Thanks..

[Chris_R_]

Apro, Here is another answer that should help http://answers.splunk.com/questions/2291/how-to-backup-restore-splunk-db-to-new-system

[Lowell]

If you are experiencing a crash you may want to contact splunk support. The backup and restore approach you used should work fine.

The first thing I would do is go to /opt/splunk/var/log/splunk/ and check out any crash* log files as well as any messages at the end of splunkd.log

BTW, did you restore to the path /opt/splunk as well? I'm assuming that you did, but if you didn't that could be your problem. Splunk has some configs that assume you aren't changing this.

I'm assuming that you also dealt with setting up the splunk users and all of that.