Deployment Architecture

How to backup Splunk for a non-clustered environment?

New Member

Hello. I have seen several threads on backing up Splunk but see a lot of different answers so I am not 100% sure which method to follow. I have a relatively simple setup consisting of one Heavy Forwarder, indexer, search head, and deployment server. No clustering. Running Splunk Enterprise 6.5.1. If any of these four main forwarders were to crash completely, what files would I need backed up to restore things back to normal? I am not necessarily interested in restoring logs, mainly concerned with the configuration related files so I don't have to rebuild everything from scratch.

0 Karma


For configurations, you should use the deployment server which deploys conf files to forwarder groups via the serverclass you define. If you lose a server that had a forwarder installed on it, you can simply install the forwarder again, add the client back to the DS, and redeploy via the DS. You may also have to add an ignoreolder than attribute so avoid re-indexing data.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...