Splunk Indexed Data Backup

[sanjubaba]

Can we take full backup of entire var directory on the Splunk indexer machine if we have enough available space?

[inventsekar · Accepted solution]

Hi @sanjubaba Yes, taking full back up of entire var directory is good, even the full /opt/splunk backup is better (the config files under /opt/splunk/etc/ will be backed up).

more details:

https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Backupindexeddata