topic Re: KVStore with replication setup in Knowledge Management

KVStore with replication setup

gdavid — Sun, 21 Feb 2016 00:54:47 GMT

I have 2 indexers and 1 search head.
i migrated from splunk 5 to 6 and had some difficulty with realtime alerts and ldap lookups. also moved from windows to linux.

anyway my work around was to dump the ldap data i was looking for into a kvstore (wanted to give it a try before failing back to csv lookup). i then wanted to setup a automatic lookup to have the searches always come back with the extra data from ldap i was looking for.

the kvstore setup on the search head was fine, but i cant seem to get it to replicate to the indexers (which seems to be necessary if you use the automatic lookups).

I tried to create the collection on all 3 servers, i tried to create the lookup table on all 3, i also manually enabled replication = true. none of these combinations seem to get the collection data on all the servers. can someone explain step by step ?

Re: KVStore with replication setup

s2_splunk — Sun, 21 Feb 2016 10:00:02 GMT

Are you on V6.3? That is the first version that replicates KVStore lookups to indexers.
Either way, I would probably stick with the csv-based lookups.

Re: KVStore with replication setup

gdavid — Sun, 21 Feb 2016 11:22:08 GMT

yup, all 3 servers are on 6.3.1

Re: KVStore with replication setup

gdavid — Sun, 21 Feb 2016 11:22:19 GMT

fresh installs

Re: KVStore with replication setup

earakam — Wed, 13 Apr 2016 05:14:54 GMT

has this been solved?
because i kind of have the same issue of replicating kv store.

Re: KVStore with replication setup

gdavid — Wed, 13 Apr 2016 13:45:03 GMT

no answer, i gave up. i will wait for the next few versions and hopefully its documented a little better also.