Restoring Splunk Data to a Different Location (Out of Place)

You can restore a Splunk cluster to a different location (out of place).

Before You Begin

Ensure that you perform one of the following tasks before a restore operation:

• Stop injecting data into Splunk indexes.

• Stop the Splunkd service on all indexer peer nodes.

• Ensure that the Splunk version on the destination server is compatible to the Splunk version on the source server.

Procedure

1. From the Command Center navigation pane, go to Protect > Big data.

   The Big data page appears.

2. Click Splunk.

3. In the row for the cluster, click the action button , and then click Restore.

   The Backup content page appears.

4. Select the indexes that you want to restore, and then click Restore.

   The Restore dialog box appears.

5. Select the Restore to another Splunk instance check box, and then select the cluster to restore the indexes to.

6. To rename the indexes during restore, click Advanced options, and then select the Rename indexes during restore check box. In the Suffix string box, enter the string you want to add to the end of the index name.

7. To restore the deleted buckets, click Advanced options, and then select the Restore deleted buckets in thawed directory check box.

8. Click OK.