Splunk Backup

[lohit]

I am facing problems with restoring splunk.

I require the searches, indexed data and users created on one installation of splunk to reflect on a fresh installation of splunk.

The steps I followed are:

1. For restoring data, I copied “defaultdb” folder from Splunk/var/lib/splunk/defaultdb ; “search” folder from Splunk/etc/apps ; “users” folder from Splunk/etc after stopping the splunk services.

2. Then, after stopping the splunk services on the fresh installation, I replaced the existing “users” and “search” folders with the ones I had copied. But, the saved searches and users did not reflect in Splunk.

3. Also, when I replaced defaultdb (after stopping the splunk services) in the fresh installation, splunk did not start and it says that splunkd started and then stopped.

Let me know where am I making a mistake and how to correct it. I need it urgently.

[mcronkrite]

I think you should be able to exclude some directories. e.g.

$SPLUNK_HOME$/var/run/splunk/dispatch/ 
$SPLUNK_HOME$/var/run/searchpeers/

[alacercogitatus]

When I transfer copies of Splunk, I take entire backups of etc and var. Make sure they are the SAME version! I'm assuming a *nix system based on the direction of your slashes in the question.

So on your command line on the old system.

cd $SPLUNK_HOME
tar cvfz splunk_backup.tgz etc var

On the new system:

cd $SPLUNK_HOME
tar xvfz splunk_backup.tgz

And chose the option to overwrite everything if requested.

[SamHTexas]

Would you please show. How I can perform incremental Splunk Ent backups on Daily or weekly basis for small recoveries? Is there an app or process to do regular backups for a distributed environments? Thank u

[lohit]

Thank you lukejadamec,
Changing the duplicate ids worked.I suppose this was the issue why splunk was giving error.

[lukejadamec]

You can copy the contents of defaultdb/db and defaultdb/colddb to the same location on the new install.
You need to make sure that there are no duplicate unique IDs or you will get an error when you restart Splunk. The unique ID is the last set of numbers of the db folders after the last underscore, and you can change them by hand to whatever you want, just make sure no two are the same.

[lohit]

Hi alacercogitatus,

Thanks for your reply.

I have splunk on windows and the Splunk was re-installed on the same machine. So I only have these 3 folders from the previous splunk instance now: defaultdb, search and users.

Please suggest how to get the indexed data into new installation.