topic Re: What is the impact on kvsore data the clean kvstore or move mongo in Splunk Enterprise

What is the impact on kvsore data the clean kvstore or move mongo

WorapongJ — Wed, 23 Apr 2025 08:14:30 GMT

I’m trying to understand Splunk KV Store to determine what happens when it fails to start or shows a "failure to restore" status. I’ve found two possible solutions, but I'm not sure whether either command will delete all data in the KV Store?

Solution1:
- ./splunk stop
- mv $SPLUNK_HOME/var/lib/splunk/kvstore/mongo /path/to/copy/kvstore/mongo_old
-./splunk start

Solution2:

- ./splunk stop
- ./splunk clean kvstore --local
-./splunk start

Re: What is the impact on kvsore data the clean kvstore or move mongo

livehybrid — Wed, 23 Apr 2025 09:25:29 GMT

Hi @WorapongJ

Both of these will result in an empty KV Store, although with the first you will have a copy of it to wherever you moved it to.

What is it you are trying to achieve here?

For KV Store troubleshooting check out https://docs.splunk.com/Documentation/Splunk/latest/Admin/TroubleshootKVstore

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: What is the impact on kvsore data the clean kvstore or move mongo

WorapongJ — Wed, 23 Apr 2025 15:22:11 GMT

What is it you are trying to achieve here?

I would just like to know the impact in case I encounter a KV Store status failure. How can I identify which apps, such as ES, might be affected If I remove or clear kvstore data?

Re: What is the impact on kvsore data the clean kvstore or move mongo

VatsalJagani — Wed, 23 Apr 2025 17:17:11 GMT

@WorapongJ- Yes in both case you will loose data.

And I know you are trying to understand the impact of it on Splunk. But there is usually a recovery option available for KVstore/Mongo depending on what has happened or what's the issue.

I hope this helps!!!