Deployment Architecture

How to backup all data Splunk has indexed?

areeter
Explorer

Hi everyone!

I would like to do a quick and dirty backup of all of my data Splunk has ever indexed. Am I fine to stop Splunk, then just take a copy of everything under $SPLUNK_HOME/var/lib/splunk ?

Thanks!

0 Karma

praveenbandi
Explorer

have you changed any of default path in index.conf? if not the actual db path will be,

$SPLUNK_HOME/var/lib/splunk /*

So I would say simply back-up the folder after shutdown the splunk service(preferred) .

Steps would be,

  1. run the above command suggested by @areeter something like this | rest /services/data/indexes | stats values(*expanded) as * by title
  2. make sure the path are same $SPLUNK_HOME/var/lib/splunk/.
  3. Stop the server ./splunk stop
  4. backup the path, cp index_pah new_path

Hope this will helps you.

0 Karma

areeter
Explorer

Cheers for that.

In that second link it states: For smaller amounts of data, shut down Splunk and just make a copy of your database directories before performing the upgrade... Where is that DB directory? Under $SPLUNK_HOME/var/lib/splunk ?

0 Karma

davebrooking
Contributor

The default location for indexes is $SPLUNK_HOME/var/lib/splunk, but when you create an index you have options to store the Home Path, Cold Path and Thawed Path elsewhere. Querying the index rest endpoint will give you a lot of information regarding your indexes, including their paths. Try the search command

| rest /services/data/indexes

and you should see what you need to backup.

Dave

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...