Hello, We were using ITSI  4.3.1. as it had some issues, we decided to uninstall & freshly install 4.7.2.  We took backup of current configuration using "create backup job"  on ITSI GUI. And, I verified that, we had backup jobs stored on /var/itsi/backups directory on respective search head server. However, after installing 4.7.2 i can't see any backup jobs available on respective directory. it got overwritten by 4.7.2 backups as below. [root@server backups]# pwd /opt/splunk/var/itsi/backups [root@server backups]# ls ItsiDefaultScheduledBackup-1620340301.zip ItsiDefaultScheduledBackup-1620343842.zip   Is there any way to retrieve full & partial backups which we took on earlier version (4.3.2) as we had all our services, KPI's there and we don't have any other backups taken for same ? Thanks in advance for your support.  ... View more

Hello All,   We have 20 indexers and 5 HF's in our Environment. HF's are forwarding their data to indexers. I'd need to find out,  which servers are sending logs to HF's. is there any SPL query i can use for same ? Thanks ... View more

Hi, We have a search head cluster of 8 members in which KV store is failing frequently. We used to start services manually. I'd like to create a report which should contains when exactly  kv store got failed & when it got up. I am not sure in which logs we can find this info.  Could anyone help me with the query for same ? Thanks   ... View more