Create a partial backup of ITSI

Create a partial backup of IT Service Intelligence (ITSI) if you want to back up a subset of your KV store objects. You can back up services, service templates, teams, glass tables, and configuration files. When selecting one of these object types, dependent objects are automatically selected to preserve the functionality of the objects after they are restored. In some cases, you can choose whether or not to include dependent objects in the backup.

Prerequisites

• You must have the itoa_admin role or the write_itsi_backup_restore capability to create a backup job.
• Before creating a backup, make sure no service templates are syncing. Check the sync status of service templates by selecting Configuration > Service Templates from the ITSI main menu.

Steps

1. From the ITSI main menu, select Configuration then Additional Configuration then Backup/Restore.
2. Select Create Job then Create Backup Job.
3. On the Backup settings page, select Full backup.
4. Provide a name and description of the backup job.
5. (Optional) Toggle Include .conf files to back up the configuration files located in $SPLUNK_HOME/etc/apps/SA-ITOA/local and $SPLUNK_HOME/etc/apps/itsi/local:
   • alert_actions.conf
   • app_common_flags.conf
   • commands.conf
   • deep_dive_drilldowns.conf
   • distsearch.conf
   • drilldownsearch_offset.conf
   • fields.conf
   • glasstable_icon_library.conf
   • inputs.conf
   • itsi_event_management.conf
   • itsi_notable_event_retention.conf
   • itsi_notable_event_severity.conf
   • itsi_notable_event_status.conf
   • itsi_service_analyzer.conf
   • itsi_settings.conf
   • limits.conf
   • macros.conf
   • notable_event_actions.conf
   • props.conf
   • savedsearches.conf
   • transforms.conf

   ITSI backs up these .conf files only if they exist in a non-default directory, such as $SPLUNK_HOME/etc/apps/itsi/local. For more information, see About configuration files. When restored, the backed up .conf file overrides the existing local version.

6. (Optional) Include other .conf files to back up the configuration files located in the local folder of other applications $SPLUNK_HOME/etc/apps/~/local:
   • macros.conf
   • savedsearches.conf
7. Toggle Include dependencies if you have objects from other applications that are dependent on ITSI objects, and need to be included in your backup.
8. Select Next. Select the objects to include in the backup.
9. (Optional) Select Change Settings to change the objects that are selected when you select a service. By default, dependent services are selected. The KPI base searches, threshold templates, and team associated with a service are always included in the backup.
10. (Optional) Although entities are not listed in the partial backup page, you can include them in the backup file by selecting Entities in the Settings dialog box.
11. After making your selections, verify the objects that you selected.
12. Select Next to review the list of objects included in your backup.
13. Select Next to run checks that notify you about any potential issues with your backup, such as missing dependent objects. You can either add these objects before the backup, or create these dependent objects first and then include them as part of your backup file.
14. Select Next to complete a final review of your backup and see a summary of objects.
15. Select Start Backup.

Check backup job status

You can check the status of the backup on the Backup/Restore Jobs page. When the backup job completes, the status updates to "Completed", and a confirmation message appears in the Messages notifications.

You cannot run completed partial backup jobs again.

What happens when you back up a service

When you back up a service, ITSI also backs up the following objects:

• KPI base searches
• Threshold templates
• Teams

You can also choose whether to back up the following associated objects:

• Dependent services
• Entities that match service entity rules
• A linked service template

If you do not choose to back up an associated object, the dependency between a service and the object breaks when you restore.

What happens when you back up a service template

When you back up a service template, all the services linked to the service template are added to the backup. If you choose to not back up a linked service, it will not exist in the restored environment.

What happens when you back up a team

When you back up a team, all the services associated with that team are added to the backup. You can deselect any services you do not want to back up.

What happens when you back up a glass table

When you back up a glass table, all of the services associated with that glass table are added to the backup. If you choose not to back up a service that the glass table depends on, any visualizations that use KPIs from the service will no longer function.

Glass table images and access control lists (ACLs) are always included in the backup when you back up a glass table.

What happens when you back up a deep dive

When you back up a deep dive, all services associated with that deep dive are also added to the backup. If you choose not to back up a service that the deep dive depends on, any KPI swimlanes from the service will no longer function if the service does not exist in the restored environment.

What happens when you back up a correlation search

When you back up a correlation search, all services associated with that correlation search are also added to the backup. If you don't back up a service the correlation search depends on, the search will still generate events with the associated service ID, but Episode Review won't be able to look up the service information.

What happens when you back up an aggregation policy

Because aggregation policies aren't directly associated with services, no services are backed up with an aggregation policy by default.

What happens when you back up a service analyzer

When you back up a service analyzer, all the services associated with that service analyzer are added to the backup. You can remove any services you do not want to back up.

What happens when you back up a saved episode review

When you back up a saved episode review, all the services and notable event aggregation policies linked to this saved episode review are added to the backup. You can remove any services and notable event aggregation policies you do not want to back up.

Next steps

To restore the backup you created, see Restore a full or partial backup of ITSI.