https://community.splunk.com/t5/Deployment-Architecture/How-to-use-KV-Store-in-a-search-head-cluster/m-p/201572#M7521 <P>"""When I created <STRONG>manually</STRONG> KV Store on one of the search heads, it didn't replicate to the other peers"""<BR /> =&gt; In SHC, any manual (editing configuration file) won't be replicated. So, you're right. Not replicated. </P> <P>. """ As I understood from the docs, it shouldn't replicate through SHC,"""<BR /> =&gt; Docs making you believe KVStore is not replicated in SHC is not great. Can put a link so that doc team can improve the page? </P> <P>Once SHC is enabled, KVstore data will be automatically replicated to SHC members. So, even if one SH node is down, other SH nodes will keep the same data available. </P> <P>I recommend to visit the following links, and try to create a custom app and add collections.conf for KVStore settings and transforms.conf for lookups. Try it in a standalone instance to make sure it works. Then, you can deploy the custom app from Deployer to SHC. </P> <P><A href="http://dev.splunk.com/view/SP-CAAAEY7">http://dev.splunk.com/view/SP-CAAAEY7</A><BR /><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/ConfigureKVstorelookups">http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/ConfigureKVstorelookups</A></P> Sun, 06 Nov 2016 23:55:24 GMT Masa 2016-11-06T23:55:24Z https://community.splunk.com/t5/Deployment-Architecture/How-to-use-KV-Store-in-a-search-head-cluster/m-p/201571#M7520 <P>Hello<BR /> I have a search head cluster with 3 peers.<BR /> Now I want to use KV Store within that cluster, with <CODE>|inputlookup</CODE>`|lookup` commands.<BR /> What is the correct way to do that?</P> <P>When I created manually KV Store on one of the search heads, it didn't replicate to the other peers, so I cannot run lookup queries from the other search heads.</P> <P>As I understood from the docs, it shouldn't replicate through SHC, but there should be a way to 'remotely' query the KV Store.</P> Tue, 01 Nov 2016 15:35:31 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-use-KV-Store-in-a-search-head-cluster/m-p/201571#M7520 ehudb 2016-11-01T15:35:31Z https://community.splunk.com/t5/Deployment-Architecture/How-to-use-KV-Store-in-a-search-head-cluster/m-p/201572#M7521 <P>"""When I created <STRONG>manually</STRONG> KV Store on one of the search heads, it didn't replicate to the other peers"""<BR /> =&gt; In SHC, any manual (editing configuration file) won't be replicated. So, you're right. Not replicated. </P> <P>. """ As I understood from the docs, it shouldn't replicate through SHC,"""<BR /> =&gt; Docs making you believe KVStore is not replicated in SHC is not great. Can put a link so that doc team can improve the page? </P> <P>Once SHC is enabled, KVstore data will be automatically replicated to SHC members. So, even if one SH node is down, other SH nodes will keep the same data available. </P> <P>I recommend to visit the following links, and try to create a custom app and add collections.conf for KVStore settings and transforms.conf for lookups. Try it in a standalone instance to make sure it works. Then, you can deploy the custom app from Deployer to SHC. </P> <P><A href="http://dev.splunk.com/view/SP-CAAAEY7">http://dev.splunk.com/view/SP-CAAAEY7</A><BR /><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/ConfigureKVstorelookups">http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/ConfigureKVstorelookups</A></P> Sun, 06 Nov 2016 23:55:24 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-use-KV-Store-in-a-search-head-cluster/m-p/201572#M7521 Masa 2016-11-06T23:55:24Z