Configuration Backup

[shocko]

I'm running Splunk Enterprise 8.0.5 on Windows 2016 and looking to upgrade to 8.2.3. We run the following:

• 2 indexers
• 1 Search head
• 1 Master Node [Cluster Master, Deployment Server and License Master]

We currently are only backing up the index files which is very risky so I need to get the configuration backed up as well.  From reading the documents it seems that generally we only need to backup:

• $SPLUNK_HOME/etc/

Is there any requirement to backup /var/ or any other folders though? 

[isoutamo · Accepted solution]

Hi

Basically it should be enough that you are backing up SPLUNK_HOME/etc and SPLUNK_DB directory, even there are some other status files under SPLUNK_HOME/var. If you can do offline update then the easiest/safest way is to do full backup of SPLUNK_HOME and SPLUNK_DB dir for all those nodes. Then the possible rollback to the previous version will be easier.

BUT if you has started those nodes and realise later on that you must do a rollback then you will be lost events which has arrived after update.

r. Ismo

[shocko]

Thanks for the update. What about the KV store? Does that not need to be backed up also ?

[isoutamo]

If you are backing up var as offline then you have it. Otherwise you should do it manually.

[shocko]

Thanks. I'm a little confused by the documentation on this regard. I don't see where it specifically references backing up /var/ but i see this which indicates to create a kvstore backup Back up and restore search head cluster settings - Splunk Documentation

[isoutamo]

Sorry, I am meaning $SPLUNK_HOME/var not /var.

[shocko]

Ah yes, makes sense now. Offline backup i.e. all services stopped so no need to run the KVStore online backup commands.