• For ITSI backup and restore, We can back up and restore ITSI configuration data using either the Backup/Restore UI in Splunk Web, or by manually running the kvstore_to_json.py script from the command line.
• The ITSI backup backs up ITSI configuration data stored in the KV store which includes services, entities, KPIs, KPI base searches, teams, glass tables, service analyzer views, and deep dives.
• Note that the backup does not include summary index data, notable events, or other data stored in Splunk indexes.
Steps to create full backup:
• Click Configure > Backup/Restore.
• Then Click on Create new Job and then select Create Backup Job.
• After clicking creating Create Backup Job, type in a name for the backup job and click create.
Restore a full backup
• When you restore from a backup listed in the Backup/Restore jobs page, ITSI merges the JSON data contained in the backup .zip file with your existing KV store data.
• New elements such as services or KPIs added since the backup are added, existing elements that match an element in the backup are replaced, and all other existing elements are preserved.
Steps to restore full backup:
• In the Backup/Restore Jobs list, find the backup from which you want to restore. Click Edit > Restore Backup.
• Click Start Restore.
• The configurations from backup file will be restored.
If you are still facing issue regarding itsi backup and restore Feel free to Ask Doubts in the Comment Box Below and Don’t Forget to Follow us on 👍 Social Networks, happy Splunking >😉
