Clone and restore the image

  1. Restart the machine and clone it with your favorite imaging utility.
  2. After cloning the image, use the imaging utility to restore it into another physical or virtual machine.
  3. Run the cloned image. Splunk services start automatically.
  4. Use the CLI to restart Splunk Enterprise to remove the cloneprep information:
    CODE 
    splunk restart

    Note: You must restart Splunk Enterprise from the CLI to delete the cloneprep file. Restarting the Splunk service does not perform the deletion.
  5. Confirm that the $SPLUNK_HOME\cloneprep file has been deleted.

The image is now ready for deployment.