Can you help me with a Splunk Backup Question?

[johann2017]

I am running Splunk Enterprise version 6.6.2. I have four Splunk servers in a non-clustered environment: One search head, one heavy forwarder, one deployment server, and one indexer. In the scenario of an unrecoverable server crash, what files need to be backed up to rebuild Splunk on a new server?

Currently I am backing up everything in these two directories: /opt/splunk/etc and /opt/splunk/var

[adonio]

considering you are using default locations for indexers and apps.
on the indexers, backup splunk/etc/ (configurations) and splunk/var (indexed data and other stuff)
on the rest of the instances, splunk/etc/ is enough

i would recommend to look into splunk diag, to make your backup and recovery easier.
read here: https://docs.splunk.com/Documentation/Splunk/7.2.4/Troubleshooting/Generateadiag

hope it helps

[johann2017]

So running a diag on each of my Splunk servers will assist in a backup / recovery process? For this, should I disable dispatch, disable pool, and .dat files? Or include everything?

[adonio]

diag will simplify your backup process
on the indexers, youll probably want to backup the data too.
https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Backupindexeddata#Choose_your_backup_stra...

another elaborated answer here:
https://answers.splunk.com/answers/469816/what-is-the-best-practice-to-backup-splunk.html