topic Re: Splunk KV store Issue in Splunk Enterprise

Splunk KV store Issue

sivakrishna — Wed, 27 Sep 2023 10:19:30 GMT

Hi Team,

We have 4 Search heads are in cluster in that one Search head is getting the KV store PORT issue asking that change the port remaining 3 SHs working fine. We are unable to restart the Splunk on that particular SH. If i check the SH cluster status only 3 servers are showing now.

Splunk installed version: 9.0.4.1

for error visibility Please find the attached.

Regards,

Siva.

Re: Splunk KV store Issue

SanjayReddy — Wed, 27 Sep 2023 10:31:54 GMT

Hi @sivakrishna

it seems KVstrore port 8191 is used by other application.

can you check which process using 8191 port ,

ps -ef | grep -i 8191

if is used by other application check with os team to check and ask them use other port,

then you can start splunk and kvstore will start on port 8191

Re: Splunk KV store Issue

sivakrishna — Wed, 27 Sep 2023 10:40:12 GMT

Thanks for the reply!!

can we change the port for this server??

What will happen if i change the PORT for this single server when it's in the cluster?

Remaining 3 servers are running on the 8191 PORT.

Re: Splunk KV store Issue

SanjayReddy — Wed, 27 Sep 2023 10:46:01 GMT

Hi @sivakrishna

instaed of changing rhe port, if 8191 is already used by splunk then please kill and start the splunk

have you checked which process using 8191 ,

if you wan the change the port , you need to change port on rest search heads, which is not recomended

Re: Splunk KV store Issue

sivakrishna — Wed, 27 Sep 2023 10:56:53 GMT

Hi @SanjayReddy

If i execute the above process check command getting the below.

Re: Splunk KV store Issue

sivakrishna — Wed, 27 Sep 2023 11:00:15 GMT

Still getting the same PORT issue @SanjayReddy