Installation

What is a good backup strategy for upgrading Splunk 6.1.3 to the latest version in a stand alone environment?

pavanae
Builder

Hi All

I had gone through all the Documentation provided by Splunk and it was very helpful.

All I came to know is that we mainly need to back up all the configuration files and indexed data which were in the paths $SPLUNK_HOME/var/lib/splunk/defaultdb/db/* and $SPLUNK_HOME/etc/.

I am trying to upgrade to a newer version of Splunk, so to proceed first, I need to backup the above two directory paths and just replace them after the installation in the same location correct?

Please correct me if I am wrong.

And My Directory location for configuration files is /opt/splunk/etc/ and for indexed data is /opt/splunk/var/lib/splunk/defaultdb/db/* so I have to copy these etc and db directories to somewhere outside of Splunk and replace them after the upgrade right?

Step by step backup procedure will be helpful and appreciated. Thanks in advance.

Labels (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hello @pavanae,

Splunk does minimum changes to your configuration or index files during upgrade and 99% of the time splunk upgrade goes smoothly. However, its always a good practice to take a back up to restore your data in case of any unforeseen failures.

Since yours is a standalone and if it does not have huge amount of data, it's better to take a complete back up of your installation folder.
ie:
shutdown your instance.
Copy the complete folder to another folder.
Upgrade splunk
Start splunk

You do not need to replace your instance with backed up data since splunk does not change your config file or data but it normally changes binaries and libraries.

Read this carefully before you upgrade : http://docs.splunk.com/Documentation/Splunk/6.3.0/installation/Upgradeto6.3onUNIX

Also it's better to select "n" for this at first to see what changes will be made to your existing configuration files

Perform migration and upgrade without previewing configuration changes? [y/n]

Once you've reviewed these changes and are ready to proceed with migration and upgrade, run $SPLUNK_HOME/bin/splunk start again.

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Hello @pavanae,

Splunk does minimum changes to your configuration or index files during upgrade and 99% of the time splunk upgrade goes smoothly. However, its always a good practice to take a back up to restore your data in case of any unforeseen failures.

Since yours is a standalone and if it does not have huge amount of data, it's better to take a complete back up of your installation folder.
ie:
shutdown your instance.
Copy the complete folder to another folder.
Upgrade splunk
Start splunk

You do not need to replace your instance with backed up data since splunk does not change your config file or data but it normally changes binaries and libraries.

Read this carefully before you upgrade : http://docs.splunk.com/Documentation/Splunk/6.3.0/installation/Upgradeto6.3onUNIX

Also it's better to select "n" for this at first to see what changes will be made to your existing configuration files

Perform migration and upgrade without previewing configuration changes? [y/n]

Once you've reviewed these changes and are ready to proceed with migration and upgrade, run $SPLUNK_HOME/bin/splunk start again.

Happy Splunking!

naresha
New Member

Team,

I haven't took backup of the system and upgraded to 6.4 on Linux OS whereby it has over written the config files, now I have lost everything related to config. Noticed that updated version is installed on a different path and Index remains intact, appreciate if you can suggest on how to proceed...planning to perform below

Un-install Splunk – 6.4

Install older version 5.0
Try mapping Index’s that were existing
Check configuration to see where applications are discovered

0 Karma

pavanae
Builder

Thank you so much renjith for your response.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...