Splunk® IT Service Intelligence

Administration Manual

About the default scheduled backup in ITSI

The default scheduled backup is a full backup of your IT Service Intelligence (ITSI) environment that runs daily at 1:00 AM in the server's local time zone. The time of the backup job is displayed on the Backup/Restore Jobs page. You can't create additional scheduled backup jobs.

The following limits apply to keeping scheduled backup files in the backup history:

  • A minimum of 7 days if running a daily scheduled backup
  • A minimum of 14 days if running a weekly scheduled backup
  • A maximum of 30 days for all scheduled backup files

The oldest backup file is automatically deleted from the backup history after the retention time expires. To set the schedule and retention time period for scheduled backups, edit the settings as defined in the next section.

Edit the default scheduled backup

When you edit the default scheduled backup, you can change the name of the scheduled backup, the frequency and time to run the scheduled backup, how many days to keep the backup file, or you can disable the scheduled backup. You can't delete the scheduled backup job.


You must have the itoa_admin role to view and edit the settings for the default scheduled backup job.


  1. From the ITSI main menu, click Configuration > Backup/Restore.
  2. Open the Default Scheduled Backup.
  3. (Optional) Enable Include .conf files to back up the following configuration files located in $SPLUNK_HOME/etc/apps/SA-ITOA/local and $SPLUNK_HOME/etc/apps/itsi/local:

    ITSI only backs up these .conf files if they exist in a non-default directory, such as $SPLUNK_HOME/etc/apps/itsi/local. For more information, see About configuration files in ITSI. When restored, the backed up .conf file overrides the existing local version.

  4. Select a daily or weekly schedule, including the time, to run the scheduled backup. The default setting runs the backup job daily at 1:00 AM in the server's local time zone.
  5. Set the number of days you want to keep the backup file. The oldest backup file automatically disappears from the backup history after the retention time expires.
  6. Click Save.
Last modified on 06 October, 2023
Overview of backing up and restoring ITSI KV store data   Create a full backup of ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.18.0, 4.18.1, 4.19.0

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters