The collections saving the state of the REStream Add-on for Splunk are backed up to backup collections using saved searches. The relevant collections are:
The relevant saved searches are:
- Backup Gen - backup_restream_discovery_inventory
- Backup Gen - backup_restream_discovery_results
- Backup Gen - backup_restream_replay_results
The saved searches are scheduled to run daily at 06:00 and keep a history of the last five backups.