topic TA-pps_ondemand Error: KV Store is disabled in Getting Data In

TA-pps_ondemand Error: KV Store is disabled

chandrag — Thu, 31 Oct 2024 06:17:02 GMT

In Splunk Cloud for one of my client environment, I'm seeing below message.

TA-pps_ondemand Error: KV Store is disabled. Please enable it to start the data collection.

Please help me with suitable solution.

Re: TA-pps_ondemand Error: KV Store is disabled

gcusello — Thu, 31 Oct 2024 07:01:43 GMT

Hi @chandrag ,

on Splunk Cloud you have few chances for action, open a case to Splunk Cloud Support.

It seems that KV-Store is disabled in one component of your architecture and this is a best practice for Indexers and Heavy Forwarder, but the Add-On you're using requires KV-Store.

Ciao.

Giuseppe

Re: TA-pps_ondemand Error: KV Store is disabled

aquinol — Wed, 20 Nov 2024 15:34:50 GMT

I have the same issue. I'm on the Victoria distro of Splunk cloud. I opened a ticket with Splunk support and they say that the KV Store/Service is already enabled and running on our stack and to go to proofpoint to fix. I can't install an older version of the app to see if it works because I'm on cloud. Proofpoint initially tried to kick it back to splunk saying it's a splunk issue, so I don't know what else to do. I tried uninstalling and reinstalling the app, restarting the cloud stack, etc, so I'm basically stuck.