topic Re: KVstore folders in /opt/splunk/var/lib/splunk/kvstorebackup/ in Splunk Enterprise

KVstore folders in /opt/splunk/var/lib/splunk/kvstorebackup/

d_lim — Mon, 29 Mar 2021 03:51:01 GMT

Hi splunk community,

So on one of the search heads my SHC environment's /opt/splunk/var/lib/splunk/kvstorebackup/ directory, besides the kvdump.tar.gz, there seems to be multiple folders of tmpKVRestore_*

Those folders seem to contain the apps and the .json data.

I would like to ask if those folders are safe to be removed, and if those folders are caused by restoring splunk kvstore on the search head, which splunk did not remove it as a means of housekeeping after the successful restore?

Thanks.

Re: KVstore folders in /opt/splunk/var/lib/splunk/kvstorebackup/

manjunathmeti — Mon, 29 Mar 2021 08:38:42 GMT

hi @d_lim,
Splunk does not remove backup archived files in /opt/splunk/var/lib/splunk/kvstorebackup/ even after restoring them.
Check if the data exists in kvdump.tar.gz (you can untar it) and tmpKVRestore_* directory is there in KVStore collections. You can use lookups if look up definitions configured for these collections or below rest API endpoint. If yes then you can delete these directories and the tar file.

https://SEARCH_HEAD_IP:8089/servicesNS/nobody/APP_NAME/storage/collections/data/KVSTORE_COLLECTION_NAME

If this reply helps you, a like would be appreciated.