One correct per Splunk docs (and observation) the GUID is the GUID of the local indexer: How the indexer stores indexes - Splunk Documentation Look at the bucket naming convention section <guid> is the guid of the source peer node. The guid is located in the peer's $SPLUNK_HOME/etc/instance.cfg file. ... View more

version 7.3.0 ... View more

No, we did not ... View more

You may want to also make sure you copy $SPLUNKHOME/etc/users -- this will bring in dashboards and settings that are defined with user scope. Regarding indexes - you may not want to bring the splunk internal indexes - and only the ones with your onboarded data (assuming you don't want the internal indexes) ... View more