Restoring a Splunk Cluster to Its Current Location (In Place)


You can restore a Splunk cluster to its current location (in place).

Before You Begin

Ensure that you perform one of the following tasks before a restore operation:

  • Stop injecting data into Splunk indexes.

  • Stop the Splunkd service on all indexer peer nodes.


  1. From the navigation pane, go to Protect > Big data.

    The Apps page appears.

  2. In the row for the cluster, click the action button , and then click Restore.

    The Backup content page appears.

  3. Select the indexes that you want to restore, and then click Restore.

    The Restore dialog box appears.

  4. Click OK.