Deployment Architecture

How to use KV Store in a search head cluster?

ehudb
Contributor

Hello
I have a search head cluster with 3 peers.
Now I want to use KV Store within that cluster, with |inputlookup`|lookup` commands.
What is the correct way to do that?

When I created manually KV Store on one of the search heads, it didn't replicate to the other peers, so I cannot run lookup queries from the other search heads.

As I understood from the docs, it shouldn't replicate through SHC, but there should be a way to 'remotely' query the KV Store.

0 Karma

Masa
Splunk Employee
Splunk Employee

"""When I created manually KV Store on one of the search heads, it didn't replicate to the other peers"""
=> In SHC, any manual (editing configuration file) won't be replicated. So, you're right. Not replicated.

. """ As I understood from the docs, it shouldn't replicate through SHC,"""
=> Docs making you believe KVStore is not replicated in SHC is not great. Can put a link so that doc team can improve the page?

Once SHC is enabled, KVstore data will be automatically replicated to SHC members. So, even if one SH node is down, other SH nodes will keep the same data available.

I recommend to visit the following links, and try to create a custom app and add collections.conf for KVStore settings and transforms.conf for lookups. Try it in a standalone instance to make sure it works. Then, you can deploy the custom app from Deployer to SHC.

http://dev.splunk.com/view/SP-CAAAEY7

http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/ConfigureKVstorelookups

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...