When I make a backup of a splunk server every few days, I just usually tarball the whole /opt/splunk dir. This works fine for recovery purposes when I may need it.
But each backup is several GBs. So, I am looking for ways to trim down the backup copy while still retaining all I need for a 'full restore' of a server if every needed.
I notice that the ~/var/run/searchpeers has a lot of files + can be large in size. Can I skip this dir when I make my backup or is it crucial to the rebuild/restore?
cheers,
Damon
