What is a good backup strategy for upgrading Splunk 6.1.3 to the latest version in a stand alone environment?

[pavanae]

Hi All

I had gone through all the Documentation provided by Splunk and it was very helpful.

All I came to know is that we mainly need to back up all the configuration files and indexed data which were in the paths $SPLUNK_HOME/var/lib/splunk/defaultdb/db/* and $SPLUNK_HOME/etc/.

I am trying to upgrade to a newer version of Splunk, so to proceed first, I need to backup the above two directory paths and just replace them after the installation in the same location correct?

Please correct me if I am wrong.

And My Directory location for configuration files is /opt/splunk/etc/ and for indexed data is /opt/splunk/var/lib/splunk/defaultdb/db/* so I have to copy these etc and db directories to somewhere outside of Splunk and replace them after the upgrade right?

Step by step backup procedure will be helpful and appreciated. Thanks in advance.

[renjith_nair · Accepted solution]

Hello @pavanae,

Splunk does minimum changes to your configuration or index files during upgrade and 99% of the time splunk upgrade goes smoothly. However, its always a good practice to take a back up to restore your data in case of any unforeseen failures.

Since yours is a standalone and if it does not have huge amount of data, it's better to take a complete back up of your installation folder.
ie:
shutdown your instance.
Copy the complete folder to another folder.
Upgrade splunk
Start splunk

You do not need to replace your instance with backed up data since splunk does not change your config file or data but it normally changes binaries and libraries.

Read this carefully before you upgrade : http://docs.splunk.com/Documentation/Splunk/6.3.0/installation/Upgradeto6.3onUNIX

Also it's better to select "n" for this at first to see what changes will be made to your existing configuration files

Perform migration and upgrade without previewing configuration changes? [y/n]

Once you've reviewed these changes and are ready to proceed with migration and upgrade, run $SPLUNK_HOME/bin/splunk start again.

[naresha]

Team,

I haven't took backup of the system and upgraded to 6.4 on Linux OS whereby it has over written the config files, now I have lost everything related to config. Noticed that updated version is installed on a different path and Index remains intact, appreciate if you can suggest on how to proceed...planning to perform below

Un-install Splunk – 6.4

Install older version 5.0
Try mapping Index’s that were existing
Check configuration to see where applications are discovered

[pavanae]

Thank you so much renjith for your response.