Splunk ITSI

How to download itsi prod kvstore and restore in test environment?

rasmirr
Loves-to-Learn

HI Team,

Greetings for the DAY,

I have one prod ITSI environment, i have managed to upgrade my test environment as same version of prod one. i need help and steps on how to backup prod kvstore and restore in my test environment.

Please help me asap.

Labels (1)
0 Karma

lperini_splunk
Splunk Employee
Splunk Employee

you can use UI or kvstore_to_json script to do it. 

https://docs.splunk.com/Documentation/ITSI/4.16.0/Configure/BackupandRestoreITSIconfig

You can go to Splunk > ITSI > Configuration > Backup/Restore and upload the backup taken from the source environment and restore the ITSI objects. 

If you decides to use kvstore_to_json method, you will need to go to the host (via terminal) and run the commands manually

https://docs.splunk.com/Documentation/ITSI/4.16.0/Configure/kvstorejson

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @rasmirr,

If your prod and test instances are the same you can use full backup/restore method.

https://docs.splunk.com/Documentation/ITSI/4.16.0/Configure/FullBackup

https://docs.splunk.com/Documentation/ITSI/4.16.0/Configure/Restore

 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...