• With Backup/Restore UI in Splunk Web, it is possible to back up and restore ITSI (IT Service Intelligence) configuration data. Also, you can do this by manually executing the script kvstore_to_json.py from the command line.
• The ITSI configuration data stowed in the KV store is backed up using ITSI backup which embraces services, KPIs, KPI base searches, entities, teams, service analyzer views, glass tables, and deep dives.
• Bear in mind that the backup does not encompass notable events, summary index data, or other data stowed in Splunk indexes.
Steps to Create Full Backup:
• Choose Configure > Backup/Restore.
• Now choose Create New Job followed by clicking on Create Backup Job.
• After choosing the option Create Backup Job, specify a unique name for the backup job, and choose Create.
Restore a Full Backup:
- ITSI merges the JSON data stored in the backup .zip file with the existing data of the KV store, when you reinstate from a backup mentioned in the Backup/Restore jobs page.
- New elements like services or the KPIs are added post backup, prevailing elements that mimic an element in the backup gets replaced, and all other prevailing elements get preserved.
- Before you restore it, you need to create a backup. Also, make sure that no service templates are in sync. Verify the service template’s sync status by choosing Configuration followed by Service Templates from the main menu of ITSI.
- Make certain that all TA’s (technology add-ons), SA’s (supporting add-ons), and DA’s (domain add-ons) that are available on the old system are established on the new system.
- Before restoring do not forget to manually copy the add-ons to the new system, if you’ve made any alterations to any add-ons on the old system.
Steps to Restore Full Backup:
• In the Backup/Restore Jobs index, look for the backup from which you want to restore a full backup. Click Edit > Restore Backup.
• Choose Start Restore.
• Now, the configurations from the backup file gets restored.
If you still have doubts regarding this topic, do not hesitate to post your queries in the Comment Box below and for more interesting topics, follow us on 👍 Social Networks, Happy Splunking