topic When using splunk backup kvstore command, is the completion status logged, specifically in the case of an error/failure? in Knowledge Management https://community.splunk.com/t5/Knowledge-Management/When-using-splunk-backup-kvstore-command-is-the-completion/m-p/500844#M8408 <P>I'm looking to capture any failures of a kvstore backup that is kicked off from a script. </P> Tue, 04 Feb 2020 17:08:49 GMT andysm 2020-02-04T17:08:49Z When using splunk backup kvstore command, is the completion status logged, specifically in the case of an error/failure? https://community.splunk.com/t5/Knowledge-Management/When-using-splunk-backup-kvstore-command-is-the-completion/m-p/500844#M8408 <P>I'm looking to capture any failures of a kvstore backup that is kicked off from a script. </P> Tue, 04 Feb 2020 17:08:49 GMT https://community.splunk.com/t5/Knowledge-Management/When-using-splunk-backup-kvstore-command-is-the-completion/m-p/500844#M8408 andysm 2020-02-04T17:08:49Z Re: When using splunk backup kvstore command, is the completion status logged, specifically in the case of an error/failure? https://community.splunk.com/t5/Knowledge-Management/When-using-splunk-backup-kvstore-command-is-the-completion/m-p/500845#M8409 <P>I had the same question.<BR /> We found the following event in the internal logs of the Search Head were the kvstore backup was run:</P> <P><STRONG>127.0.0.1 - admin [03/Feb/2020:17:15:44.925 -0500] "POST /services/kvstore/backup/create HTTP/1.1" 200 1747 - - - 0ms</STRONG></P> <P>Otherwise we have yet to determine a reliable way to identify the status of a kvstore backup job from internal/introspection logs.</P> Tue, 04 Feb 2020 17:33:54 GMT https://community.splunk.com/t5/Knowledge-Management/When-using-splunk-backup-kvstore-command-is-the-completion/m-p/500845#M8409 pedromunoz 2020-02-04T17:33:54Z Re: When using splunk backup kvstore command, is the completion status logged, specifically in the case of an error/failure? https://community.splunk.com/t5/Knowledge-Management/When-using-splunk-backup-kvstore-command-is-the-completion/m-p/500846#M8410 <P>There are several ways that you can tackle this.</P> <P>Capture output from the Splunk command:</P> <PRE><CODE>./splunk show kvstore-status </CODE></PRE> <P>Use the REST API:</P> <PRE><CODE>curl -k -u user:pass <A href="https://&lt;host&gt;:&lt;mPort&gt;/services/kvstore/status" target="test_blank">https://&lt;host&gt;:&lt;mPort&gt;/services/kvstore/status</A> curl -k -u user:pass <A href="https://&lt;host&gt;:&lt;mPort&gt;/services/messages" target="test_blank">https://&lt;host&gt;:&lt;mPort&gt;/services/messages</A> </CODE></PRE> <P>Errors and warnings are logged to both splunkd.log and mongod.log</P> Fri, 07 Feb 2020 14:59:05 GMT https://community.splunk.com/t5/Knowledge-Management/When-using-splunk-backup-kvstore-command-is-the-completion/m-p/500846#M8410 codebuilder 2020-02-07T14:59:05Z