KB 146 (Splunk): Backing up the PowerConnect App in Splunk Enterprise
Platform: Splunk Enterprise
Version: 1 from 17.03.2022
Backing up the PowerConnect Splunk app may be required for upgrades and updates.
Splunk app backups consist of two different types: configuration files and indexed data.
For configuration files, create a copy of the $SPLUNK_HOME/etc/apps/BNW-app-powerconnect folder.
Additionally, you may want to back up individual user configurations in the app. Those can be found at $SPLUNK_HOME/etc/users/<username>/BNW-app-powerconnect
Configuration files include (but may not be limited to) the following objects:
Custom Sourcetype Names
For distributed deployments, perform configuration backups from the cluster manager and/or search heads
For the indexed data, you will need to create a copy of the folders for the PowerConnect index (typically called “sap”). This can be found at $SPLUNK_HOME/var/lib/splunk/<index_name>
This will likely be a large amount of data. Make sure you have storage capacity in place for a complete backup.