How to back up Splunk files?

[mdmaala]

For backing up splunk data, do i Just copy all the files in $SPLUNK_HOME/etc/ directory then replace it once a new installation was done?

[sduff_splunk · Accepted solution]

Are you installing to the same host, or different? Note that /etc/system/local can contain hostnames which may need to change.

In theory, you can install a new version of Splunk over the top of an existing one. Also, depending on the size/maturity of your deployment, you should be looking at deployment servers (https://docs.splunk.com/Documentation/Splunk/7.2.4/Updating/Aboutdeploymentserver ) to manage the config on your environment.

[mdmaala]

I see. yes, I am installing on the same host.