Back up and restore Splunk Industrial Asset Intelligence

Before upgrading Splunk Industrial Asset Intelligence, or as part of regularly-scheduled disaster recovery processes, back up your data and configurations. Restore Splunk IAI to recover lost data.

Back up Splunk IAI

This process backs up local configurations and the KV store collections relevant to Splunk IAI. It does not back up system-level configurations, such as indexes or users and roles.

This process does not work if you are backing up a version earlier than 1.2.1 on Windows.

Prerequisites

• You must have the Splunk admin role to perform this backup.
• You must have command line access to the Splunk search head or search head cluster captain.

Steps

1. From the command line, navigate to the Splunk IAI bin directory.
   • For *nix systems, type
     cd $SPLUNK_HOME/etc/apps/splunk_app_iai/bin/iai_migration.
   • For Windows systems,
     type cd %SPLUNK_HOME%\etc\apps\splunk_app_iai\bin\iai_migration
2. Start the backup process by running a script.
   • For *nix systems, type
     $SPLUNK_HOME/bin/splunk cmd python kvstore_to_json.py
   • For Windows systems, type
      %SPLUNK_HOME%\bin\splunk cmd python kvstore_to_json.py
3. Select a port. 8089 is used by default.
4. Type your Splunk admin credentials.
5. Choose a file or directory to save the backup. By default, the backup is saved to a backup directory created where you run the script. If you want to use a different directory, you must create it first.
   • The default backup directory path for *nix systems is: $SPLUNK_HOME/etc/apps/splunk_app_iai/bin/iai_migration/backup.
   • The default backup directory path for Windows systems is: %SPLUNK_HOME%\etc\apps\splunk_app_iai\bin\iai_migration\backup.
6. Type yes to back up the KV store and local configurations.
7. The backup script runs and stores your KV store data and local configurations in the specified file or directory.

Restore Splunk IAI from a backup

You can restore Splunk IAI on a search head that has the same version of Splunk IAI or a newer version of Splunk IAI installed than the one you backed up. The restore script can also perform a data migration.

The restore script is included with version 1.2.0 and later of Splunk IAI. It supports backup and restore from the following versions:

• For *nix systems, back up and restore from version 1.1.0 and later.
• For Windows systems, back up and restore from version 1.2.1 and later.

Prerequisites

• You must have Splunk Enterprise installed.
• Your user account must have the Splunk admin role.
• You must have command line access to the Splunk search head or search head cluster captain.
• The backup must be accessible from the Splunk search head or search head cluster captain.

Steps

1. Install Splunk IAI. See Install Splunk Industrial Asset Intelligence.

   If Splunk IAI is already installed and configured, and contains data in the KV store, you must remove the data in the KV store and remove the app-specific files, then install a new version of Splunk IAI.

2. Set up Splunk IAI to create indexes and roles. See Set up Splunk Industrial Asset Intelligence.
3. Access the command line on the Splunk search head or search head cluster captain that has Splunk IAI installed.
4. From the command line, navigate to the Splunk IAI bin directory.
   • For *nix systems, type cd $SPLUNK_HOME/etc/apps/splunk_app_iai/bin/iai_migration.
   • For Windows systems, type cd %SPLUNK_HOME%\etc\apps\splunk_app_iai\bin\iai_migration.
5. Start the restore process by running a script.
   • For *nix systems, type
     $SPLUNK_HOME/bin/splunk cmd python kvstore_to_json.py
   • For Windows systems, type
      %SPLUNK_HOME%\bin\splunk cmd python kvstore_to_json.py
6. Select a port. 8089 is used by default.
7. Type your Splunk admin user credentials.
8. Type the file or directory that contains the backup.
9. Type no to restore the data.
10. Type no, you do not want to perform a partial restore.
11. Type no, you do not want to persist the existing data in the KV store during the import.
12. If different from the version of Splunk IAI installed on the search head, type the version of Splunk IAI that the backup is from.
13. The restore script runs and restores your KV store data and local configurations.