Restore a full or partial backup of ITSI
Restoring a backup of IT Service Intelligence (ITSI) merges the JSON data contained in the backup ZIP file with your existing KV store data in the following ways:
- If you added new objects since you created the backup, ITSI keeps these objects.
- If an existing object matches an object in the backup file, the existing object is replaced.
- All other existing objects are preserved.
Use the command line script instead of the UI to restore a backup in the following scenarios:
- You want to delete all existing KV store objects in an ITSI instance and replace them with the objects in the backup for a clean restore.
- You want to selectively restore files in a backup. Restoring from the UI restores all of the data in the backup file.
If you restart Splunk software while a backup or restore job is in progress, the job resumes after the restart is complete. Queued jobs automatically time out if they are not completed within twelve hours. You can change the default timeout duration by updating the value of
job_queue_timeout in the
[backup_restore] stanza in a local version of itsi_settings.conf.
Version and deployment considerations
The restore modal displays a warning if a backup came from a deployment that's different from the current deployment. A different deployment means the backup came from another instance or search head cluster, depending on the deployment structure. Restoring from a different deployment might cause security issues, so consider rechecking the backup before proceeding.
ITSI supports backups taken from the the current version as well as three versions back. For example, version 4.6.x supports backups taken from version 4.3.x, 4.4.x, and 4.5.x. Restoring a backup to an earlier version isn't supported.
- You must create a backup before you can restore it. For instructions, see Create a full backup of ITSI and Create a partial backup of ITSI.
- Make sure no service templates are syncing. Check the sync status of service templates by clicking Configuration > Service Templates from the ITSI main menu.
- Make sure all technology add-ons (TAs), supporting add-ons (SAs), and domain add-ons (DAs) that exist on the old system are installed on the new system.
- If you've made modifications to any add-ons on the old system, manually copy those add-ons over the new system before restoring.
Restore from a backup
You can restore from a default scheduled backup or a backup that you created.
- On the ITSI top menu bar, click Configuration > Backup/Restore and find the backup that you want to restore from.
- Click Edit > Restore Backup.
- If you're restoring a scheduled backup, select a saved backup from the list. If you're restoring a created backup, go to the next step.
- Click Start Restore. "Restore from" is prepended to the backup name in the jobs list. A message stating that the restore job successfully completed appears in the messages dropdown list in Splunk Web.
- If you restored a backup that contains configuration files, you must restart your Splunk Enterprise instance.
Restore from a backup ZIP file
You can download any backup ZIP file that is created when you run a backup job in the UI and then restore from that backup ZIP file using the Backup/Restore Jobs UI. The maximum file size supported for uploading a backup file is 500 MB.
Perform the following steps to download a backup ZIP file:
- On the ITSI top menu bar, click Configuration > Backup/Restore and find the backup file that you want to download.
- Click Edit > Download Backup. If you are restoring a scheduled backup, select a saved backup from the list. If you are restoring a created backup, the backup file displays.
- Save the file. The backup ZIP file downloads to your local machine.
Perform the following steps to restore from a downloaded backup ZIP file:
- On the Backup/Restore Jobs page, click Create Job > Create Restore Job.
- Provide a name and an optional description of the backup.
- Click Choose File and select the previously downloaded backup ZIP file that you want to restore from.
- (Optional) Toggle Include .conf files to restore any configuration files included in the backup.
- Click Create.
ITSI uploads the backup ZIP file and the new restore job appears in the Backup/Restore Jobs list. A message stating that the restore job has successfully completed appears in the Message drop-down list in Splunk Web.
- (Optional) If you restore from a backup that contains .conf files, you must restart Splunk software.
Restore from a backup created using the command line
If you created a backup of ITSI using the
kvstore_to_json.py command line option, and you want to restore that data using the Backup/Restore Jobs page, the backup JSON files must be contained in a folder named
backup and compressed into a ZIP file. For information, see kvstore_to_json.py operations in ITSI.
How teams are restored
Team permissions are retained when teams are restored. The roles assigned to the teams must exist on the system that the backup is restored to. For example, suppose a restore creates teams called "HR" and "Finance", which have read/write access for the
finance_admin roles. If the current system doesn't have these roles, only the
itoa_admin role can access these teams. If the roles assigned to the teams don't exist on the system, you can create them either before or after restoring.
Create a partial backup of ITSI
kvstore_to_json.py operations in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.5.0 Cloud only, 4.5.1 Cloud only, 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1