I want to know what is the command and from where can i execute to exclude ( /var) folder from backing up.
If you want to backup splunk the best way is using an addon like this: "Stateful snapshot for splunk" https://splunkbase.splunk.com/app/4122/ or this: "Git version control for Splunk" https://splunkbase.splunk.com/app/4182/