Create a full backup of ITSI

Create a full backup of IT Service Intelligence (ITSI) to make a copy of all your configuration information. Taking regular backups from a healthy environment enables you to restore from a backup in the event of a disaster, or if you add a search head to a cluster. You can also take a backup before migrating to a different machine.

Make sure to be familiar with the standard backup and restore tools and procedures used by your organization.

For more information about ITSI backups, including what gets backed up, see Overview of backing up and restoring ITSI KV store data.

Prerequisites

• You must have the itoa_admin role or the write_itsi_backup_restore capability to create a backup job.
• Before creating a backup, make sure no service templates are syncing. Check the sync status of service templates by selecting Configuration then Service Templates from the ITSI main menu.

Steps

1. From the ITSI main menu, select Configuration then Additional Configuration then Backup/Restore.
2. Select Create Job then Create Backup Job.
3. On the Backup settings page, select Full backup.
4. Provide a name and description of the backup job.
5. (Optional) Toggle Include .conf files to back up the configuration files located in $SPLUNK_HOME/etc/apps/SA-ITOA/local and $SPLUNK_HOME/etc/apps/itsi/local:
   • alert_actions.conf
   • app_common_flags.conf
   • commands.conf
   • deep_dive_drilldowns.conf
   • distsearch.conf
   • drilldownsearch_offset.conf
   • fields.conf
   • glasstable_icon_library.conf
   • inputs.conf
   • itsi_event_management.conf
   • itsi_notable_event_retention.conf
   • itsi_notable_event_severity.conf
   • itsi_notable_event_status.conf
   • itsi_service_analyzer.conf
   • itsi_settings.conf
   • limits.conf
   • macros.conf
   • notable_event_actions.conf
   • props.conf
   • savedsearches.conf
   • transforms.conf

   ITSI backs up these .conf files only if they exist in a non-default directory, such as $SPLUNK_HOME/etc/apps/itsi/local. For more information, see About configuration files. When restored, the backed up .conf file overrides the existing local version.

6. (Optional) Include other .conf files to back up the configuration files located in the local folder of other applications $SPLUNK_HOME/etc/apps/~/local:
   • macros.conf
   • savedsearches.conf
7. Toggle Include dependencies if you have objects from external applications that are dependent on ITSI objects, and need to be included in your backup. Splunk knowledge objects are not included as part of the backup, but macros and saved searches from external applications are included. This toggle is turned off by default if Include .conf files is not toggled.
8. Select Next to review the list of ITSI and Splunk objects included in your backup, including saved searches, macros, and more. Verify that the correct objects and dependencies are included in your backup file.
9. Select Next. Automatic checks will notify you about potential issues with your backup file, such as missing dependent objects. You can either add these objects before the backup, or create these dependent objects first and then include them as part of your backup file.
10. Select Next to complete a final review of your backup and view a summary of objects.
11. Select Start Backup.

Check backup job status

You can check the status of the backup on the Backup/Restore Jobs page. When the backup job completes, the status updates to "Completed", and a confirmation message appears in the Messages notifications.

You can run any completed backup job again by selecting Edit then Start Backup in the Actions column. You can also modify the completed backup job before running it again.

Next steps

To restore the backup you created, see Restore a full or partial backup of ITSI.