topic Is KV Store better than a state CSV file when I need high availability in a Search Head Cluster? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Is-KV-Store-better-than-a-state-CSV-file-when-I-need-high/m-p/216082#M42511 <P><A href="http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/">http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/</A><BR /> <A href="http://dev.splunk.com/view/SP-CAAAEY7">http://dev.splunk.com/view/SP-CAAAEY7</A></P> <P>Is KV store better than state CSV when I need high availability? The scheduled search that updates the state CSV may run anywhere within the Search Head Cluster depending on the scheduler and captain's assignment. Are state CSV files replicated in an SHC?</P> Sat, 31 Oct 2015 10:54:34 GMT hylam 2015-10-31T10:54:34Z Is KV Store better than a state CSV file when I need high availability in a Search Head Cluster? https://community.splunk.com/t5/Getting-Data-In/Is-KV-Store-better-than-a-state-CSV-file-when-I-need-high/m-p/216082#M42511 <P><A href="http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/">http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/</A><BR /> <A href="http://dev.splunk.com/view/SP-CAAAEY7">http://dev.splunk.com/view/SP-CAAAEY7</A></P> <P>Is KV store better than state CSV when I need high availability? The scheduled search that updates the state CSV may run anywhere within the Search Head Cluster depending on the scheduler and captain's assignment. Are state CSV files replicated in an SHC?</P> Sat, 31 Oct 2015 10:54:34 GMT https://community.splunk.com/t5/Getting-Data-In/Is-KV-Store-better-than-a-state-CSV-file-when-I-need-high/m-p/216082#M42511 hylam 2015-10-31T10:54:34Z Re: Is KV Store better than a state CSV file when I need high availability in a Search Head Cluster? https://community.splunk.com/t5/Getting-Data-In/Is-KV-Store-better-than-a-state-CSV-file-when-I-need-high/m-p/216083#M42512 <P>If you send to ouputlookup fronting a csv the cluster will replicate it. But the idea for state is to use KVstore. That is why it was added. KVStore is mongoDB and handles replication on it's own across the cluster members. It also lets you update just the records that need updating more efficiently than doing it with a csv based lookup. <A href="http://www.georgestarcher.com/wp-content/uploads/2015/09/conf2015-LookupTalk.pdf">http://www.georgestarcher.com/wp-content/uploads/2015/09/conf2015-LookupTalk.pdf</A> </P> Mon, 02 Nov 2015 19:27:27 GMT https://community.splunk.com/t5/Getting-Data-In/Is-KV-Store-better-than-a-state-CSV-file-when-I-need-high/m-p/216083#M42512 starcher 2015-11-02T19:27:27Z