Restoring Splunk Data to a Different Location (Out of Place)


You can restore a Splunk cluster to a different location (out of place).

Before You Begin

Ensure that you perform one of the following tasks before a restore operation:

  • Stop injecting data into Splunk indexes.

  • Stop the Splunkd service on all indexer peer nodes.

  • Ensure that the Splunk version on the destination server is compatible to the Splunk version on the source server.


  1. From the navigation pane, go to Protect > Big data.

    The Apps page appears.

  2. In the row for the cluster, click the action button , and then click Restore.

    The Backup content page appears.

  3. Select the indexes that you want to restore, and then click Restore.

    The Restore dialog box appears.

  4. Select the Restore to another Splunk instance check box, and then select the cluster to restore the indexes to.

  5. Click OK.