topic Remove KVStore data after deleting collections.conf in Splunk Enterprise

Remove KVStore data after deleting collections.conf

ohbuckeyeio — Wed, 02 Jun 2021 14:53:18 GMT

Hello,

Is there a process to remove data from mongo DB when the KVStore's collections.conf and transforms.conf have been previously deleted?

I am making an assumption that the clean command for kvstore requires a collections.conf. The documentation does not state otherwise.

Thank you.

Re: Remove KVStore data after deleting collections.conf

richgalloway — Wed, 02 Jun 2021 15:57:05 GMT

Restart the SH and the data no longer in collections.conf will be removed from the KV Store.

Re: Remove KVStore data after deleting collections.conf

ohbuckeyeio — Wed, 02 Jun 2021 16:03:03 GMT

Thank you for the reply! This is interesting and brings about a few more questions.

Is it safe to assume this applies to an entire KVStore collection, as well as individual fields within the KVStore?

How does this impact replication in the case of a search head cluster and restarting a single node?

Re: Remove KVStore data after deleting collections.conf

richgalloway — Thu, 03 Jun 2021 14:30:41 GMT

As I understand it, restarts apply to individual fields as well.

I don't understand the second question so I don't have an answer for it.

Re: Remove KVStore data after deleting collections.conf

ohbuckeyeio — Thu, 03 Jun 2021 14:40:05 GMT

My apologies.

If you have a search head cluster with 3 nodes, and one is restarted, that SH performs clean up for the collections.conf items that have been removed. When replication occurs with the other SHs, will it notify its counterparts that those objects should be deleted from them as well?

Re: Remove KVStore data after deleting collections.conf

richgalloway — Fri, 04 Jun 2021 00:13:34 GMT

I believe it will, but you still should restart those other cluster members.

Re: Remove KVStore data after deleting collections.conf

ohbuckeyeio — Fri, 04 Jun 2021 15:24:21 GMT

Thank you, Rich.

Last question: Do you know if this is documented anywhere? I looked in the docs and Splunk Support to no avail.

Re: Remove KVStore data after deleting collections.conf

richgalloway — Fri, 04 Jun 2021 16:00:27 GMT

I have not found any documentation on this. It's pretty much word-of-mouth so far.

Re: Remove KVStore data after deleting collections.conf

ohbuckeyeio — Fri, 04 Jun 2021 16:12:00 GMT

Thank you. I will accept the solution, but might open an SR with Splunk to inquire. I will follow up when I have more information.