Getting Data In

Can you help me with my KVstore replication to indexers?

nawazns5038
Builder

Hi,

We have a KVstore being replicated to the indexers.

After replication to the indexers where is the data stored in the indexers?

What does path /opt/splunk/var/lib/splunk/kvstore/ mean in the indexers ?

We have changed...

SPLUNK_DB=/local/hot/ and there are two KVstore folders one in /local/hot and other in /opt/splunk/var/lib/splunk/kvstore/ ??

Is it safe to delete /opt/splunk/var/lib/splunk/kvstore/ ?

Thanks

0 Karma

gjanders
SplunkTrust
SplunkTrust

As per How to replicate a Search Head Cluster's KV Store lookup data to an Indexer? the answer explains the kvstore is replicated via CSV files included in the bundle, there are also some conf presentations covering this topic but I don't have them handy

There is no kvstore to kvstore sync, so the kvstore on the indexers does not relate to that on the search heads, therefore it does not matter where you kvstore is located on the indexing tier, the search tier doesn't mind...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...