I am looking to see if there is a documented back out process when upgrading from a 6.1.2 to a 6.4.1. What should I have backed up in case an issue arises?
$SPLUNK_HOME/etc
contains all of your settings and apps, so that is what I backup when doing an upgrade.
I usually tar up the entire splunk directory except for the var/lib/splunk (usually keep mine outside of the tree.) If I ever need to restore from backup (and I have) I just replace the directory.