We have two search heads that will be configured in active and standby using the load balancer. Are there any custom scripts available to take incremental backups of the configuration and KV store from the primary node and replicated to standby?. Please advice.
Also please advice: is there a way to configure HA in Search head itself without clustering?
Back up configuration information
All Splunk's configuration information is contained in configuration files. To back up the set of configuration files, make an archive or copy of $SPLUNK_HOME/etc/. This directory, along with its subdirectories, contains all the default and custom settings for your Splunk install, and all apps, including saved searches, user accounts, tags, custom source type names, and other configuration information.
Copy this directory to a new Splunk instance to restore. You don't have to stop Splunk to do this.