KB 146 (Splunk): Backing up the PowerConnect App in Splunk Enterprise

Description

Backing up the PowerConnect Splunk app may be required for upgrades and updates.

Resolution

Splunk app backups consist of two different types: configuration files and indexed data.

• For configuration files, create a copy of the $SPLUNK_HOME/etc/apps/BNW-app-powerconnect folder.

  • Additionally, you may want to back up individual user configurations in the app. Those can be found at $SPLUNK_HOME/etc/users/<username>/BNW-app-powerconnect

  • Configuration files include (but may not be limited to) the following objects:

    • Configuration settings

    • Saved Searches

    • User Accounts

    • Tags

    • Custom Sourcetype Names

  • For distributed deployments, perform configuration backups from the cluster manager and/or search heads

• For the indexed data, you will need to create a copy of the folders for the PowerConnect index (typically called “sap”). This can be found at $SPLUNK_HOME/var/lib/splunk/<index_name>

  • This will likely be a large amount of data. Make sure you have storage capacity in place for a complete backup.

Additional Information

• Splunk documentation on backing up indexed data

• Splunk documentation on backing up configuration files