Splunk Enterprise

Configuration Backup

shocko
Contributor

I'm running Splunk Enterprise 8.0.5 on Windows 2016 and looking to upgrade to 8.2.3. We run the following:

  • 2 indexers
  • 1 Search head
  • 1 Master Node [Cluster Master, Deployment Server and License Master]

We currently are only backing up the index files which is very risky so I need to get the configuration backed up as well.  From reading the documents it seems that generally we only need to backup:

  • $SPLUNK_HOME/etc/

Is there any requirement to backup /var/ or any other folders though? 

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

Basically it should be enough that you are backing up SPLUNK_HOME/etc and SPLUNK_DB directory, even there are some other status files under SPLUNK_HOME/var. If you can do offline update then the easiest/safest way is to do full backup of SPLUNK_HOME and SPLUNK_DB dir for all those nodes. Then the possible rollback to the previous version will be easier.

BUT if you has started those nodes and realise later on that you must do a rollback then you will be lost events which has arrived after update.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Basically it should be enough that you are backing up SPLUNK_HOME/etc and SPLUNK_DB directory, even there are some other status files under SPLUNK_HOME/var. If you can do offline update then the easiest/safest way is to do full backup of SPLUNK_HOME and SPLUNK_DB dir for all those nodes. Then the possible rollback to the previous version will be easier.

BUT if you has started those nodes and realise later on that you must do a rollback then you will be lost events which has arrived after update.

r. Ismo

0 Karma

shocko
Contributor

Thanks for the update. What about the KV store? Does that not need to be backed up also ?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
If you are backing up var as offline then you have it. Otherwise you should do it manually.

shocko
Contributor

Thanks. I'm a little confused by the documentation on this regard. I don't see where it specifically references backing up /var/ but i see this which indicates to create a kvstore backup Back up and restore search head cluster settings - Splunk Documentation

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Sorry, I am meaning $SPLUNK_HOME/var not /var.

shocko
Contributor

Ah yes, makes sense now. Offline backup i.e. all services stopped so no need to run the KVStore online backup commands. 

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...