Splunk Enterprise

What is the path to the etc folder on windows or Unix hosts. How do I copy the etc folder for backing up purposes?

SamHTexas
Builder

What is the path to the etc folder on windows or Unix hosts. How do I copy the etc folder for backing up purposes? Please show steps. Are there more to backup on the Splunk enterprise or ES for daily / weekly back ups?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, each Splunk instance must be backed up separately. 

That's all I would do, but my failure tolerance is pretty high.  I've been to sites where they've set up automatic commits to git for every config file and dashboard.  It's cool and it did come in handy at least once, but that may be too much for most customers.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The path is $SPLUNK_HOME/etc, where $SPLUNK_HOME normally is /opt/splunk or \Program Files\Splunk.

How to copy the directory will vary based on the tools at your disposal, company policy, etc. so exact steps can't be shown.  It could be as simple as creating a tarball, however.

tar -czf /tmp/splunk_etc_backup /opt/splunk/etc
---
If this reply helps you, Karma would be appreciated.
0 Karma

SamHTexas
Builder

Thank u sir for this. Are there any apps for such back ups? Also is the etc & the kvstore the only items to back up for basic backups? If yes, do I back up the etc & kvstore on each individual Splunk Ent. server? Thank u very much in advance.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of apps for backing up Splunk, but there is at least one for backing up the KVStore in splunkbase.

Yes, backing up etc and kvstore is enough.

---
If this reply helps you, Karma would be appreciated.
0 Karma

SamHTexas
Builder

Thanks Rich. I appreciate your response as always. So does the etc & KVstore need to be backed up from each Splunk server? to perform a basic backup? What else would u do for back up going a step above the basic backup? Thax

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, each Splunk instance must be backed up separately. 

That's all I would do, but my failure tolerance is pretty high.  I've been to sites where they've set up automatic commits to git for every config file and dashboard.  It's cool and it did come in handy at least once, but that may be too much for most customers.

---
If this reply helps you, Karma would be appreciated.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...