Splunk ITSI

Is it possible to take a partial backup of multiple services in ITSI?

mallempatisreed
Explorer

hi All,

I have 15 services with multiple KPI's in test environment which I need to move to another environment. using partial backup can I move all of these 15 services to the desired environment. in the documentation it has been given for one service, will it work for multiple services as well?

If so can someone help me how to do that

Example of my Services:

  1. ABCD Hybris shgjh
  2. ABCD Hybris hsjlkk
  3. ABCD Hybris bjksjk
  4. XYZ Hybris yyriyi
  5. XYZ Hybris wterety
  6. XYZ Hybris poiopi

Hybris is the only common in the services, will it work if i use like below

 [ 
 {
    "object_type": "service",
    "title_list": "^* Hybris *$"
  }
]
 OR

 [ 
 {
    "object_type": "service",
    "title_list": "^ ABCD Hybris shgjh$" , "^ ABCD Hybris hsjlkk$", "^ ABCD Hybris yyriyi$"
  }
]

http://docs.splunk.com/Documentation/ITSI/3.0.0/Configure/kvstore_to_json.pyoperations#Partial_backu...

Thanks,
Sree

0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

You can actually create a partial backup through the UI: https://docs.splunk.com/Documentation/ITSI/latest/Configure/BackupandRestoreITSIconfig#Create_a_part...

When you select a service to back up, ITSI also backs up the following objects:

-KPI base searches
-Threshold templates
-Teams

When you select a service to back up, you can choose whether or not to back up the following objects:

-Dependent services
-Entities that match service entity rules
-Linked service template

The dependency between the service and these objects breaks if you do not choose to back up the associated object:

-If you back up a service that has dependent services without also backing up the dependent services, the service will no longer be dependent on the services after restoring.
-If you back up a service without backing up the entities that match the service entity rules, the entities will no longer be associated with the service if the entities do not exist in the restored environment.
-If you back up a service that is linked to a service template without also backing up the service template, the service will no longer be linked to the service template after restoring.

Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...