Monitoring Splunk

Backup and restore of Splunk??

apro
Path Finder

Hi,

Been trying to backup and restore of Splunk indexer and the steps that I took to backup our splunk server is:

- stop Splunk svcs via ./splunk stop
- tar the whole folder of /opt/splunk into splunk_backup.gz
- start up splunk svcs again.

I tried to restore this backup on a fresh installation of Splunk on a secondary machine to test but keep encountering this issue..

After restoration and starting splunk services successfully,I tried to log in to splunkweb but it gives an error page.I've checked and notice splunkweb is running but splunkd has crashed..

Any help on the backup and restore process??

Thanks..

Tags (3)

Chris_R_
Splunk Employee
Splunk Employee
0 Karma

Lowell
Super Champion

If you are experiencing a crash you may want to contact splunk support. The backup and restore approach you used should work fine.

The first thing I would do is go to /opt/splunk/var/log/splunk/ and check out any crash* log files as well as any messages at the end of splunkd.log

BTW, did you restore to the path /opt/splunk as well? I'm assuming that you did, but if you didn't that could be your problem. Splunk has some configs that assume you aren't changing this.

I'm assuming that you also dealt with setting up the splunk users and all of that.

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...