For indexes you'd want $SPLUNK_HOME/var/lib/splunk and all it's sub-directories.
For configs (including the definitions of indexes, apps, includes all user definitions, etc etc..) you'd want $SPLUNK_HOME/etc
Where $SPLUNK_HOME is usually /opt/splunk, but not always. Make sure Splunk is stopped when copying or moving it's files!
At a high-level thats how you'd transfer a Splunk installation, minus the binaries, with a lot of detail glossed over in the interest of brevity.
Hope it helps 🙂
Cheers.
... View more