Deployment Architecture

How to backup Splunk for a non-clustered environment?

New Member

Hello. I have seen several threads on backing up Splunk but see a lot of different answers so I am not 100% sure which method to follow. I have a relatively simple setup consisting of one Heavy Forwarder, indexer, search head, and deployment server. No clustering. Running Splunk Enterprise 6.5.1. If any of these four main forwarders were to crash completely, what files would I need backed up to restore things back to normal? I am not necessarily interested in restoring logs, mainly concerned with the configuration related files so I don't have to rebuild everything from scratch.

0 Karma


For configurations, you should use the deployment server which deploys conf files to forwarder groups via the serverclass you define. If you lose a server that had a forwarder installed on it, you can simply install the forwarder again, add the client back to the DS, and redeploy via the DS. You may also have to add an ignoreolder than attribute so avoid re-indexing data.

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...