You can restore a Splunk cluster to its current location (in place).
Before You Begin
Ensure that you perform one of the following tasks before a restore operation:
Stop injecting data into Splunk indexes.
Stop the Splunkd service on all indexer peer nodes.
From the navigation pane, go to Protect > Big data.
The Apps page appears.
In the row for the cluster, click the action button , and then click Restore.
The Backup content page appears.
Select the indexes that you want to restore, and then click Restore.
The Restore dialog box appears.