Back up and restore configuration files for Splunk App for SOAR Export

On Splunk Enterprise, you can back up and restore the Splunk App for SOAR Export configuration files in case you encounter any problems with the upgrade process overwriting your existing configuration files.

Back up the Splunk App for SOAR Export configuration files

To back up the Splunk App for SOAR Export configuration files, save a copy of the /local directory on your Splunk Enterprise instance. The default location is: 

/opt/splunk/etc/apps/phantom/local

Restore the Splunk App for SOAR Export configuration files

Perform the following tasks to restore the Splunk App for SOAR Export configuration files.

  1. Install the latest version of the Splunk App for SOAR Export.
  2. On Splunk Enterprise, move the Splunk App for SOAR Export backup /local configuration files into the current /local directory. 
    cp <path of backup>/*.conf /opt/splunk/etc/apps/phantom/local
  3. Restart Splunk. 
    /opt/splunk/bin/splunk restart