Splunk® Phantom App for Splunk

Use the Splunk Phantom App for Splunk to Forward Events

This documentation does not apply to the most recent version of Splunk® Phantom App for Splunk. For documentation on the most recent version, go to the latest release.

Backup and restore configuration files for Splunk Phantom App for Splunk

On Splunk Enterprise, you can backup and restore the Splunk Phantom App for Splunk configuration files in case you encounter any problems with the upgrade process overwriting your existing configuration files.

Backup the Splunk Phantom App for Splunk configuration files

To backup the Splunk Phantom App for Splunk configuration files, save a copy of the /local directory on your Splunk Enterprise instance. The default location is: 

/opt/splunk/etc/apps/phantom/local

Restore the Splunk Phantom App for Splunk configuration files

Perform the following tasks to restore the Splunk Phantom App for Splunk configuration files.

  1. Install the latest version of the Splunk Phantom App for Splunk.
  2. On Splunk Enterprise, move the Splunk Phantom App for Splunk backup /local configuration files into the current /local directory. 
    cp <path of backup>/*.conf /opt/splunk/etc/apps/phantom/local
  3. Restart Splunk. 
    /opt/splunk/bin/splunk restart
Last modified on 27 May, 2021
Configure how Splunk Phantom and Splunk SOAR handle multivalue fields in Splunk ES notable events   Troubleshoot the Splunk Phantom App for Splunk

This documentation applies to the following versions of Splunk® Phantom App for Splunk: 4.1.3

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters