Restoring a Splunk Cluster to Its Current Location (In Place)

You can restore a Splunk cluster to its current location (in place).

Before You Begin

Ensure that you perform one of the following tasks before a restore operation:

• Stop injecting data into Splunk indexes.

• Stop the Splunkd service on all indexer peer nodes.

Procedure

1. From the navigation pane, go to Protect > Big data.

   The Apps page appears.

2. In the row for the cluster, click the action button , and then click Restore.

   The Backup content page appears.

3. Select the indexes that you want to restore, and then click Restore.

   The Restore dialog box appears.

4. Click OK.