About the default scheduled backup in ITSI

The default scheduled backup is a full backup of your IT Service Intelligence (ITSI) environment that runs daily at 1:00 AM in the server's local time zone. The time of the backup job is displayed on the Backup/Restore Jobs page. You can't create additional scheduled backup jobs.

The following limits apply to keeping scheduled backup files in the backup history:

• A minimum of 7 days if running a daily scheduled backup
• A minimum of 14 days if running a weekly scheduled backup
• A maximum of 30 days for all scheduled backup files

The oldest backup file is automatically deleted from the backup history after the retention time expires. To set the schedule and retention time period for scheduled backups, edit the settings as defined in the next section.

Edit the default scheduled backup

When you edit the default scheduled backup, you can change the name of the scheduled backup, the frequency and time to run the scheduled backup, how many days to keep the backup file, or you can disable the scheduled backup. You can't delete the scheduled backup job.

Prerequisites

You must have the itoa_admin role to view and edit the settings for the default scheduled backup job.

Steps

1. From the ITSI main menu, click Configuration > Backup/Restore.
2. Open the Default Scheduled Backup.
3. (Optional) Enable Include .conf files to back up the following configuration files located in $SPLUNK_HOME/etc/apps/SA-ITOA/local and $SPLUNK_HOME/etc/apps/itsi/local:
   • alert_actions.conf
   • app_common_flags.conf
   • commands.conf
   • deep_dive_drilldowns.conf
   • distsearch.conf
   • drilldownsearch_offset.conf
   • fields.conf
   • glasstable_icon_library.conf
   • inputs.conf
   • itsi_event_management.conf
   • itsi_notable_event_retention.conf
   • itsi_notable_event_severity.conf
   • itsi_notable_event_status.conf
   • itsi_service_analyzer.conf
   • itsi_settings.conf
   • limits.conf
   • macros.conf
   • notable_event_actions.conf
   • props.conf
   • savedsearches.conf (only in $SPLUNK_HOME/etc/apps/SA-ITOA/local)
   • transforms.conf

   ITSI only backs up these .conf files if they exist in a non-default directory, such as $SPLUNK_HOME/etc/apps/itsi/local. For more information, see About configuration files in ITSI. When restored, the backed up .conf file overrides the existing local version.

4. Select a daily or weekly schedule, including the time, to run the scheduled backup. The default setting runs the backup job daily at 1:00 AM in the server's local time zone.
5. Set the number of days you want to keep the backup file. The oldest backup file automatically disappears from the backup history after the retention time expires.
6. Click Save.