Restore a full or partial backup of ITSI

Restoring a backup of IT Service Intelligence (ITSI) merges the JSON data contained in the backup ZIP file with your existing KV store data in the following ways:

• If you added new objects since you created the backup, ITSI keeps these objects.
• If an existing object matches an object in the backup file, the existing object is replaced.
• All other existing objects are preserved.

If you restart Splunk software while a backup or restore job is in progress, the job resumes after the restart is complete. Queued jobs automatically time out if they are not completed within twelve hours. You can change the default timeout duration by updating the value of job_queue_timeout in the [backup_restore] stanza in a local version of itsi_settings.conf.

Version and deployment considerations

The restore modal displays a warning if a backup came from a deployment that's different from the current deployment. A different deployment means the backup came from another instance or search head cluster, depending on the deployment structure. Restoring from a different deployment might cause security issues, so consider rechecking the backup before proceeding.

ITSI supports backups taken from the the current version, and up to three versions earlier than the current version. Restoring a backup to an earlier version isn't supported.

Prerequisites

• You must create a backup before you can restore it. For instructions, see Create a full backup of ITSI and Create a partial backup of ITSI.
• Make sure no service templates are syncing. Check the sync status of service templates by selecting Configuration then Service Monitoring then Service Templates from the ITSI main menu.
• Make sure all technology add-ons (TAs), supporting add-ons (SAs), and domain add-ons (DAs) that exist on the old system are installed on the new system.
• If you've made modifications to any add-ons on the old system, manually copy those add-ons over the new system before restoring.

When performing a restore operation, be sure to provide the correct permissions (Global permissions if an object is not created within the ITSI App) to any newly-created Splunk Objects.

Restore from a backup

You can restore from a default scheduled backup or a backup that you created.

1. On the ITSI top menu bar, select Configuration then Additional Configuration then Backup/Restore and find the backup that you want to restore from.
2. Select Edit then Restore Backup.
3. If you're restoring a scheduled backup, select a saved backup from the list. If you're restoring a created backup, go to the next step.
4. Select Start Restore. "Restore from" is prepended to the backup name in the jobs list. A message stating that the restore job successfully completed appears in the messages dropdown list in Splunk Web.
5. If you restored a backup that contains configuration files, you must restart your Splunk Enterprise instance.

Restore from a backup ZIP file

You can download any backup ZIP file created when you run a backup job in ITSI. Use the Backup/Restore Jobs page to restore your downloaded ZIP file. The maximum file size supported for a backup file is 500 MB.

Complete these steps to download an existing backup ZIP file.

1. On the ITSI top menu bar, select Configuration then Additional Configuration then Backup/Restore and find the backup file that you want to download.
2. Select Edit then Download Backup. If you are restoring a scheduled backup, select a saved backup from the list.
3. Save the file on your computer.

Complete these steps to restore from any downloaded backup ZIP file.

1. On the Backup/Restore Jobs page, select Create Job then Create Restore Job.
2. Provide a name and an optional description for the backup.
3. Upload a downloaded ZIP file from your computer.
4. (Optional) Toggle Include .conf Files to restore any configuration files included in the backup.
5. Select Next. Review the contents of your backup file and confirm that there are no missing objects.
   Some objects in your ZIP file may have missing dependencies that need to be added to the backup file and installed before the restore process can continue. Some objects require installation before you can continue restoring the file. Other objects won't block the restore job, but not installing these objects may cause your glass tables, deep dives or other objects to break. These objects are marked with either a red error icon or warning icon depending on their impact.
6. Select Start Restore.

If the restore fails and generates a missing splunk objects error for objects that were not shown in the IT Service Intelligence UI before starting the restore attempt, verify whether the objects exist in your environment, and confirm the permissions for those objects.

How teams are restored

Team permissions are retained when teams are restored. The roles assigned to the teams must exist on the system that the backup is restored to. For example, suppose a restore creates teams called "HR" and "Finance", which have read/write access for the hr_admin and finance_admin roles. If the current system doesn't have these roles, only the itoa_admin role can access these teams. If the roles assigned to the teams don't exist on the system, you can create them either before or after restoring.