Create a full backup of ITSI

Create a full backup of IT Service Intelligence (ITSI) to make a copy of all your configuration information. Taking regular backups from a healthy environment enables you to restore from a backup in the event of a disaster, or if you add a search head to a cluster. You can also take a backup before migrating to a different machine.

Make sure to be familiar with the standard backup and restore tools and procedures used by your organization.

For more information about ITSI backups, including what gets backed up, see Overview of backing up and restoring ITSI KV store data.

Prerequisites

• You must have the itoa_admin role or the write_itsi_backup_restore capability to create a backup job.
• Before creating a backup, make sure no service templates are syncing. Check the sync status of service templates by clicking Configuration > Service Templates from the ITSI main menu.

Steps

1. From the ITSI main menu, click Configuration > Backup/Restore.
2. Click Create Job > Create Backup Job.
3. Select Full Backup.
4. Provide a name and description of the backup job.
5. (Optional) Enable Include .conf files to back up the following configuration files located in $SPLUNK_HOME/etc/apps/SA-ITOA/local and $SPLUNK_HOME/etc/apps/itsi/local:
   • alert_actions.conf
   • app_common_flags.conf
   • commands.conf
   • deep_dive_drilldowns.conf
   • distsearch.conf
   • drilldownsearch_offset.conf
   • fields.conf
   • glasstable_icon_library.conf
   • inputs.conf
   • itsi_event_management.conf
   • itsi_notable_event_retention.conf
   • itsi_notable_event_severity.conf
   • itsi_notable_event_status.conf
   • itsi_service_analyzer.conf
   • itsi_settings.conf
   • limits.conf
   • macros.conf
   • notable_event_actions.conf
   • props.conf
   • savedsearches.conf
   • transforms.conf

   ITSI backs up these .conf files only if they exist in a non-default directory, such as $SPLUNK_HOME/etc/apps/itsi/local. For more information, see About configuration files. When restored, the backed up .conf file overrides the existing local version.

6. Click Create.

The backup job appears on the Backup/Restore Jobs page with the status "Queued" until the job runs. When the backup job finishes, the status changes to "Completed" and a confirmation message appears in the Messages drop-down list in Splunk Web.

You can run any completed backup job again by clicking Edit > Start Backup in the Actions column. You can also modify the completed backup job before running it again.

Next steps

To restore the backup you created, see Restore a full or partial backup of ITSI.