Understanding Backup and Restore Capabilities in Splunk Cloud Platform

Available Languages

Updated:November 4, 2026

Document ID:SPLK056049

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

Organizations frequently ask whether Splunk Cloud Platform can perform a complete environment restore if indexes, dashboards, knowledge objects, inputs, applications, or other configuration items are accidentally deleted, modified, or impacted by unauthorized changes.

Understanding the distinction between platform-managed backups, disaster recovery capabilities, and customer-initiated restores is important when planning data protection and business continuity strategies.

Resolution

Are backups maintained in Splunk Cloud Platform?

Yes. Splunk maintains platform-managed backups of Splunk Cloud Platform environments to support operational resiliency and disaster recovery processes. These backups are managed internally and are not directly accessible for customer use.

Can an entire Splunk Cloud environment be restored from backups on request?

Splunk Cloud documentation does not provide a guarantee for customer-initiated, point-in-time restoration of an entire Splunk Cloud environment from platform-managed backups. Any request involving recovery of deleted data or configuration objects may require review and evaluation based on the specific circumstances.

What happens if an index is deleted?

Index deletion is considered a permanent and irreversible action. When an index is deleted, all data contained within that index is removed, and the operation cannot be reversed.

What about dashboards, lookups, applications, inputs, and knowledge objects?

Recovery possibilities may vary depending on the affected object, the timing of the change, and the environment configuration. Requests for recovery are evaluated on a case-by-case basis and cannot be guaranteed.

What options are available for enhanced disaster recovery?

Splunk offers Cross-Region Disaster Recovery (CRDR) for organizations that require additional resiliency. CRDR replicates data and configuration components to a secondary region, helping reduce recovery risks in the event of a disaster scenario.

Components replicated through CRDR can include:

Indexed data
Configuration files
Dashboards
Saved searches
Applications
Lookups
KV Store collections
Other supported knowledge objects

Best Practices

To minimize the risk of data loss or configuration loss:

Implement change management procedures before modifying production environments.
Restrict administrative permissions to authorized personnel.
Maintain exported copies of critical dashboards, lookups, applications, and configuration files when appropriate.
Review business continuity requirements and evaluate Cross-Region Disaster Recovery if enhanced recovery capabilities are required.
Test recovery procedures and operational processes regularly.

See the links below for additional information:

Splunk Cloud Service Description
Manage Splunk Cloud Platform Indexes
About Cross-Region Disaster Recovery