The best way will be to copy the whole var folder and replace the new var folder in the new server?
You should start by reading Back up indexed data in the Managing Indexers and Clusters manual. It also contains information about restoring archived indexed data.
If you want to back up all your buckets--hot, warm, and cold--and you have a small amount of data, then you can shut down Splunk and make a copy of the database directories.
if i copied the whole var folder and paste it on another server with splunk it works right?
