Documentation: 3.2.2
|  Print Version Contents
This page last updated: 04/14/08 06:04pm

Splunk backup options

Back up your configurations or all your data.

Back up configurations

To back up your configurations, make an archive or copy of $SPLUNK_HOME/etc/. This directory contains all the default and custom settings for your Splunk install. Copy this directory to a new Splunk instance to restore.

Back up your entire installation

Step 1: Stop the server

From $SPLUNK_HOME/bin/, type the command ./splunk stop.

Use ps aux | grep splunk or ps -ef | grep splunk to ensure that the Splunk Server processes have actually stopped before you proceed with backups.

While Splunk is down, it will miss events that come in via FIFO queues or network ports. You may want to consider writing these events to a file during the backup period, then loading the file into Splunk when it comes back up.

Step 2: Back up $SPLUNK_HOME

/opt/splunk (or whichever directory you installed Splunk in) contains your saved searches, user accounts, tags, custom source type names and configuration files. $SPLUNK_HOME also contains your indexes, unless you moved your index directory ($SPLUNK_DB) somewhere else. By default $SPLUNK_DB is set to $SPLUNK_HOME/var/lib/splunk, so a backup of /opt/splunk should capture it.

You may also want to take a snapshot of your data sources, e.g. var/log, along with your Splunk Server. This enables you to rebuild the index or revisit original sources for debugging.

Step 3: Start the server again

Your Splunk Server will continue indexing data where it left off. If you have a network port configured as a data input, though, you may miss some events while the server is down.

Before you Restore

If you restore a full /opt/splunk backup, check these two items before starting the new instance.

License key (Splunk Professional)

Your backup may include an expired license key in $SPLUNK_HOME/etc/splunk.license. Install a current one or get a temporary evaluation key from splunk.com if you don't have one.

Active input configurations

If you don't want your restored Splunk Server to instantly begin adding new data to its index, move any active inputs.conf files out of the way before starting the server. This is useful if you want to revisit an old index without having new events added to it.

# mv $SPLUNK_HOME/etc/bundles/local/input.conf $SPLUNK_HOME/etc/bundles/local/input.conf.disabled
# mv $SPLUNK_HOME/etc/bundles/default/input.conf $SPLUNK_HOME/etc/bundles/default/input.conf.disabled
# splunk start
Previous: 64-bit operating systems    |    Next: How do configuration files work?

Comments

No comments have been submitted.

Log in to comment.