You can use the Commvault software to back up and restore Splunk in the enterprise clustered environments.
Indexes You Can Back Up
Clustered indexes: You can back up only warm and cold buckets in the clustered indexes.
Note: You can retain deleted buckets based on their retention policy.
Backups You Can Perform
Full backups, using IntelliSnap
Incremental backups, using IntelliSnap
When You Can Perform Backups
On a schedule: The server plan that you assign manages scheduled backups
On demand: You can perform on-demand backups at any time
Note: You can have more than one schedule for the default subclient.
Indexes You Can Restore
Backups You Can Use for Restores
The most recent backup: For example, restore the most recent backup to its original location
A backup from a specific date: For example, restore data to a point in time before it became unusable
Backups from a date range: For example, restore data that was accidentally deleted
Destinations You Can Restore To
To a source server (in place)
To a different server (out of place)