Search Head Backup

Ever wanted a simple way to backup your dashboards and knowledge objects in Splunk Cloud, well that is what this is. There are other really powerful solutions that backup to Git repositories using a self-managed Heavy Forwarder, but I wanted a simpler solution that was fully self contained in Splunk Cloud. Search Head Backup runs a scheduled search locally on the Search Head and stores your dashboards and knowledge objects to a Splunk index daily, allowing you to manually restore any of these to any point in time based on the index retention period. The specific objects collected is configurable using a lookup table. If you are on Splunk Classic, raise a support request to get this installed on your ES and ITSI Search Heads to back them up too!