Splunk Enterprise

Configuration Backup

shocko
Contributor

I'm running Splunk Enterprise 8.0.5 on Windows 2016 and looking to upgrade to 8.2.3. We run the following:

  • 2 indexers
  • 1 Search head
  • 1 Master Node [Cluster Master, Deployment Server and License Master]

We currently are only backing up the index files which is very risky so I need to get the configuration backed up as well.  From reading the documents it seems that generally we only need to backup:

  • $SPLUNK_HOME/etc/

Is there any requirement to backup /var/ or any other folders though? 

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

Basically it should be enough that you are backing up SPLUNK_HOME/etc and SPLUNK_DB directory, even there are some other status files under SPLUNK_HOME/var. If you can do offline update then the easiest/safest way is to do full backup of SPLUNK_HOME and SPLUNK_DB dir for all those nodes. Then the possible rollback to the previous version will be easier.

BUT if you has started those nodes and realise later on that you must do a rollback then you will be lost events which has arrived after update.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Basically it should be enough that you are backing up SPLUNK_HOME/etc and SPLUNK_DB directory, even there are some other status files under SPLUNK_HOME/var. If you can do offline update then the easiest/safest way is to do full backup of SPLUNK_HOME and SPLUNK_DB dir for all those nodes. Then the possible rollback to the previous version will be easier.

BUT if you has started those nodes and realise later on that you must do a rollback then you will be lost events which has arrived after update.

r. Ismo

0 Karma

shocko
Contributor

Thanks for the update. What about the KV store? Does that not need to be backed up also ?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
If you are backing up var as offline then you have it. Otherwise you should do it manually.

shocko
Contributor

Thanks. I'm a little confused by the documentation on this regard. I don't see where it specifically references backing up /var/ but i see this which indicates to create a kvstore backup Back up and restore search head cluster settings - Splunk Documentation

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Sorry, I am meaning $SPLUNK_HOME/var not /var.

shocko
Contributor

Ah yes, makes sense now. Offline backup i.e. all services stopped so no need to run the KVStore online backup commands. 

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...