Archive

Would like to know what is the best way of backing up and restore splunk data?

oranger1426
Explorer

The best way will be to copy the whole var folder and replace the new var folder in the new server?

Tags (1)

ChrisG
Splunk Employee
Splunk Employee

You should start by reading Back up indexed data in the Managing Indexers and Clusters manual. It also contains information about restoring archived indexed data.

ChrisG
Splunk Employee
Splunk Employee

If you want to back up all your buckets--hot, warm, and cold--and you have a small amount of data, then you can shut down Splunk and make a copy of the database directories.

oranger1426
Explorer

if i copied the whole var folder and paste it on another server with splunk
it works right?