Deployment Architecture

How to backup Splunk for a non-clustered environment?

johannterc
New Member

Hello. I have seen several threads on backing up Splunk but see a lot of different answers so I am not 100% sure which method to follow. I have a relatively simple setup consisting of one Heavy Forwarder, indexer, search head, and deployment server. No clustering. Running Splunk Enterprise 6.5.1. If any of these four main forwarders were to crash completely, what files would I need backed up to restore things back to normal? I am not necessarily interested in restoring logs, mainly concerned with the configuration related files so I don't have to rebuild everything from scratch.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

For configurations, you should use the deployment server which deploys conf files to forwarder groups via the serverclass you define. If you lose a server that had a forwarder installed on it, you can simply install the forwarder again, add the client back to the DS, and redeploy via the DS. You may also have to add an ignoreolder than attribute so avoid re-indexing data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...