I'm looking to capture any failures of a kvstore backup that is kicked off from a script.
There are several ways that you can tackle this.
Capture output from the Splunk command:
./splunk show kvstore-status
Use the REST API:
curl -k -u user:pass https://<host>:<mPort>/services/kvstore/status
curl -k -u user:pass https://<host>:<mPort>/services/messages
Errors and warnings are logged to both splunkd.log and mongod.log
I had the same question.
We found the following event in the internal logs of the Search Head were the kvstore backup was run:
127.0.0.1 - admin [03/Feb/2020:17:15:44.925 -0500] "POST /services/kvstore/backup/create HTTP/1.1" 200 1747 - - - 0ms
Otherwise we have yet to determine a reliable way to identify the status of a kvstore backup job from internal/introspection logs.