I am running Splunk Enterprise version 6.6.2. I have four Splunk servers in a non-clustered environment: One search head, one heavy forwarder, one deployment server, and one indexer. In the scenario of an unrecoverable server crash, what files need to be backed up to rebuild Splunk on a new server?
Currently I am backing up everything in these two directories: /opt/splunk/etc and /opt/splunk/var
considering you are using default locations for indexers and apps.
on the indexers, backup
splunk/etc/ (configurations) and
splunk/var (indexed data and other stuff)
on the rest of the instances,
splunk/etc/ is enough
i would recommend to look into splunk diag, to make your backup and recovery easier.
read here: https://docs.splunk.com/Documentation/Splunk/7.2.4/Troubleshooting/Generateadiag
hope it helps
diag will simplify your backup process
on the indexers, youll probably want to backup the data too.
another elaborated answer here: