How to backup Splunk for a non-clustered environment?

[johannterc]

Hello. I have seen several threads on backing up Splunk but see a lot of different answers so I am not 100% sure which method to follow. I have a relatively simple setup consisting of one Heavy Forwarder, indexer, search head, and deployment server. No clustering. Running Splunk Enterprise 6.5.1. If any of these four main forwarders were to crash completely, what files would I need backed up to restore things back to normal? I am not necessarily interested in restoring logs, mainly concerned with the configuration related files so I don't have to rebuild everything from scratch.

[skoelpin]

For configurations, you should use the deployment server which deploys conf files to forwarder groups via the serverclass you define. If you lose a server that had a forwarder installed on it, you can simply install the forwarder again, add the client back to the DS, and redeploy via the DS. You may also have to add an ignoreolder than attribute so avoid re-indexing data.