Create a partial backup of ITSI

Create a partial backup of IT Service Intelligence (ITSI) if you want to back up a subset of your KV store objects. You can back up services, service templates, teams, glass tables, and configuration files. When selecting one of these object types, dependent objects are automatically selected to preserve the functionality of the objects after they are restored. In some cases, you can choose whether or not to include dependent objects in the backup.

Prerequisites

• You must have the itoa_admin role or the write_itsi_backup_restore capability to create a backup job.
• Before creating a backup, make sure no service templates are syncing. Check the sync status of service templates by clicking Configuration > Service Templates from the ITSI main menu.

Steps

1. From the ITSI main menu, clck Configuration > Backup/Restore.
2. Click Create Job > Create Backup Job.
3. Select Partial Backup.
4. Provide a name and description of the backup.
5. (Optional) Toggle Include .conf files to back up the following configuration files located in $SPLUNK_HOME/etc/apps/SA-ITOA/local and $SPLUNK_HOME/etc/apps/itsi/local:
   • alert_actions.conf
   • app_common_flags.conf
   • commands.conf
   • deep_dive_drilldowns.conf
   • distsearch.conf
   • drilldownsearch_offset.conf
   • fields.conf
   • glasstable_icon_library.conf
   • inputs.conf
   • itsi_event_management.conf
   • itsi_notable_event_retention.conf
   • itsi_notable_event_severity.conf
   • itsi_notable_event_status.conf
   • itsi_service_analyzer.conf
   • itsi_settings.conf
   • limits.conf
   • macros.conf
   • notable_event_actions.conf
   • props.conf
   • savedsearches.conf
   • transforms.conf

   ITSI backs up these .conf files only if they exist in a non-default directory, such as $SPLUNK_HOME/etc/apps/itsi/local. For more information, see About configuration files. When restored, the backed up .conf file overrides the existing local version.

6. Click Next.
7. On the partial backup page, select the objects to include in the backup. If you select one object type, it can cause other object types to be automatically selected if there are dependencies between the objects.
8. (Optional) Click Change Settings to change the objects that are selected when you select a service. By default, dependent services are selected. The KPI base searches, threshold templates, and team associated with a service are always included in the backup.
9. (Optional) Although entities are not listed in the partial backup page, you can include them in the backup file by selecting Entities in the Settings dialog box.
10. After making your selections, verify the objects that you selected.
11. Click Save and Backup.

The backup job appears on the Backup/Restore Jobs page with the status Queued until the job runs. When the backup job finishes, the status changes to Completed and a confirmation message appears in the Messages drop-down list in Splunk Web.

You can edit any partial backup job before it starts. When the backup job starts, you see a read-only view that lists the objects contained in the partial backup.

You can run any completed backup job again by clicking Edit > Start Backup in the Actions column. You can also modify the completed backup job before running it again.

What happens when you back up a service

When you back up a service, ITSI also backs up the following objects:

• KPI base searches
• Threshold templates
• Teams

You can also choose whether to back up the following associated objects:

• Dependent services
• Entities that match service entity rules
• A linked service template

If you do not choose to back up an associated object, the dependency between a service and the object breaks when you restore.

What happens when you back up a service template

When you back up a service template, all the services linked to the service template are added to the backup. If you choose to not back up a linked service, it will not exist in the restored environment.

What happens when you back up a team

When you back up a team, all the services associated with that team are added to the backup. You can deselect any services you do not want to back up.

What happens when you back up a glass table

When you back up a glass table, all of the services associated with that glass table are added to the backup. If you choose not to back up a service that the glass table depends on, any visualizations that use KPIs from the service will no longer function.

Glass table images and access control lists (ACLs) are always included in the backup when you back up a glass table.

What happens when you back up a deep dive

When you back up a deep dive, all services associated with that deep dive are also added to the backup. If you choose not to back up a service that the deep dive depends on, any KPI swimlanes from the service will no longer function if the service does not exist in the restored environment.

What happens when you back up a correlation search

When you back up a correlation search, all services associated with that correlation search are also added to the backup. If you don't back up a service the correlation search depends on, the search will still generate events with the associated service ID, but Episode Review won't be able to look up the service information.

What happens when you back up an aggregation policy

Because aggregation policies aren't directly associated with services, no services are backed up with an aggregation policy by default.

Next steps

To restore the backup you created, see Restore a full or partial backup of ITSI.