Backup and restore configuration files for Splunk Phantom App for Splunk

On Splunk Enterprise, you can backup and restore the Splunk Phantom App for Splunk configuration files in case you encounter any problems with the upgrade process overwriting your existing configuration files.

Backup the Splunk Phantom App for Splunk configuration files

To backup the Splunk Phantom App for Splunk configuration files, save a copy of the /local directory on your Splunk Enterprise instance. The default location is:

/opt/splunk/etc/apps/phantom/local

Restore the Splunk Phantom App for Splunk configuration files

Perform the following tasks to restore the Splunk Phantom App for Splunk configuration files.

1. Install the latest version of the Splunk Phantom App for Splunk.
2. On Splunk Enterprise, move the Splunk Phantom App for Splunk backup /local configuration files into the current /local directory.

   cp <path of backup>/*.conf /opt/splunk/etc/apps/phantom/local

3. Restart Splunk.

   /opt/splunk/bin/splunk restart