Splunk backup and restore procedure

[VK18]

Dear Team,

We are planning to upgrade our existing underlying OS/VM infrastructure. As part of this process, we need to ensure the backup and restoration of our Splunk environment in case any issues arise.

Below, you can find the details of our environment:

Search Head Cluster (SHC)
A standalone Splunk Security SH.
Indexer cluster
All other management servers(DS/CM/deployer/LM)
Heavy Forwarders/Universal Forwarders (UFs)

In addition to backing up $SPLUNK_HOME/etc and $SPLUNK_HOME/var, as well as the kvstore, are there any other components or data that we need to back up to ensure a successful restoration process?

[somesoni2]

You'll want to backup your index data as well. https://docs.splunk.com/Documentation/Splunk/9.1.1/Indexer/Backupindexeddata