Recover your Splunk Cloud Platform environment after a disaster

After your Splunk Cloud Platform environment has failed over to a secondary cloud service provider (CSP) region because of a qualified regional disaster event, the environment operates as if it were in the primary region until Splunk can recover services in the primary region. After this time, Splunk declares the disaster over and works with you to recover your Splunk Cloud Platform environment back to the primary CSP region in which it is hosted.

This process, known as a failback, requires maintenance windows to perform the realignment of services to the primary CSP region. Splunk Support requires that you work with them to fail back your Splunk Cloud Platform environment to the primary region within 2 weeks of when full service functionality has been restored to the primary CSP region.

To file a failback request, follow these steps:

1. Visit the Splunk Support Portal.
2. File a support case.
3. In the ticket, indicate that you want to fail back your Splunk Cloud Platform deployment to its primary region.

Splunk Support will coordinate the failback by working with you to schedule maintenance windows to perform the move. After the failback is complete, Splunk Support will advise you. At this time, confirm that your data collection and forwarding infrastructure sends data to the instance in the primary CSP region.