I would like backup a "search head" in one cluster (The folder splunk/etc/). The search head is under linux with specific user for run backup.
For that, i used a script in bash.
This script is on windows machine and he use this command "PSCP.EXE -p -q -r -i keys name_machine@IP:folder_backup/"
He work for other machine splunk (Heavy forwarder). But on "search head" some folders are not backed up (its ramdom).
Maybe search head is under replicaiton so i need function "shadow copy" for few folders ?
"Back up at least one search head cluster (SHC) member periodically
As a best practice, periodically back up the SHC state to ensure you can restore knowledge objects in their current state in case of a catastrophic failure. For details about what to back up on the SHC and how, see Back up and restore search head cluster settings in the Splunk Enterprise Distributed Search manual."