topic Re: "Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why? in All Apps and Add-ons

"Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why?

ananthan123 — Tue, 15 Aug 2017 14:28:52 GMT

Hello,

I have installed Splunk App for Windows Infrastructure, but when I run setup I am getting this error message:

Splunk v6.2.0+
OK: Splunk v6.3.3 detected
Key value store must be enabled. Please enable it. Learn more.

From which server it is throwing this error message? There are few Windows servers. How do I fix it ?

Re: "Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why?

alemarzu — Tue, 15 Aug 2017 15:05:42 GMT

Hello @ananthan123,

The host that it is reporting it, is probably the one were you are trying to install Windows Infrastructure app. This apps needs kvstore to work properly if I'm not mistaken.

First, just to be sure wich host is reporting that error:

index=_internal (sourcetype=mongod OR sourcetype=splunkd) log_level!=INFO KV store

This could probably a permission issues, so do this.

Go to $SPLUNK_HOME\var\lib\splunk\kvstore
Change the permissions recursively to mongo folder to the accound that is running Splunk.
Restart Splunk.

Hope it helps.

Re: "Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why?

ChrisG — Tue, 15 Aug 2017 15:06:11 GMT

There are several previous Answers postings that talk about how to troubleshoot this issue. It could be a permissions and/or cert issue. See https://answers.splunk.com/answers/338872/splunk-app-for-windows-infrastructure-how-to-troub.html for one discussion, and links to others.

Re: "Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why?

ananthan123 — Tue, 15 Aug 2017 16:43:04 GMT

Thank you very much. Do I need to go on all the Windows Servers and need to change the permission?

Re: "Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why?

alemarzu — Tue, 15 Aug 2017 18:00:10 GMT

Only those that present the kvstore error.

Re: "Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why?

nwieseler — Wed, 18 Jul 2018 05:37:49 GMT

I downvoted this post because 404 on the link

Re: "Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why?

ChrisG — Thu, 19 Jul 2018 00:36:46 GMT

@nwieseler: I just checked the link and it worked for me. Can you try again in an incognito tab?

Re: "Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why?

nwieseler — Thu, 19 Jul 2018 00:58:01 GMT

Just tried on mobile and nothing? Not a big deal.

Re: "Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why?

ChrisG — Thu, 19 Jul 2018 15:23:41 GMT

Got it, the post is restored now and you should be able to see it.

Re: "Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why?

nwieseler — Thu, 19 Jul 2018 16:40:53 GMT

And now I can't cancel my vote after one day... Sorry man.

Re: "Key value store must be enabled" prompted during Splunk App for Windows Infrastructure setup -- Why?

gordo32 — Wed, 10 Oct 2018 17:21:10 GMT

I ran into this on Linux, and it was because the server wasn't configured to be a slave to an Splunk Enterprise license master. Added the following stanza to server.conf

[license]
master_uri: = https://license-server:8089

After restarting Splunk, KVStore is up and running again. A couple other side-effects is that the "Map groups" action disappears under LDAP Settings (presumably, the mapping uses kv store / mongodb to store the role -> group mappings).

Another option would be to install an Enterprise license locally on the server, but since this is a search head only, that doesn't make a lot of sense.