topic Re: Where can I disable kvstore? in Monitoring Splunk

Where can I disable kvstore?

mikefg — Tue, 29 Aug 2023 18:39:01 GMT

Running 9.0.x now, and I'm getting messages about kvstore issues on indexers, etc. I understand I can disable kvstore on some systems, but not all.

Where do I need it upgraded to wiredTiger and where can I disable it?

Search heads - enabled and upgraded to wiredTiger
Enterprise security search head - enabled and upgraded to wiredTiger
Cluster master - mmapv1
Indexers - mmapv1
Deployment server - mmapv1
Heavy forwarders - enabled and upgraded to wiredTiger

Re: Where can I disable kvstore?

richgalloway — Wed, 30 Aug 2023 00:13:14 GMT

I would enable KVStore on search heads and disable it everywhere else. HFs are not search heads and don't need KVStore unless you have an app that specifically calls for it.

Re: Where can I disable kvstore?

gcusello — Wed, 30 Aug 2023 08:38:11 GMT

Hi @mikefg ,

as @richgalloway said, it's a best practice to disable KV-Store in all Splunk servers except Search Heads to use the resources for other purposes,

even if, there are some Add-Ons, that must be installed on HFs or IDXs, that disabling KV-Store will give you error messages because they use KV-Store .

Anyway, you can disable KV-Store adding to server.conf the following stanza:

[kvstore] disabled = true

Ciao.

Giuseppe

Re: Where can I disable kvstore?

gcusello — Thu, 31 Aug 2023 21:21:46 GMT

Hi @mikefg

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Where can I disable kvstore?

isoutamo — Fri, 01 Sep 2023 07:18:20 GMT

I don’t remember any other commonly used TA on HFs than the newest DB Connect which are requiring kvstore. Unfortunately that is not clearly said on documentation if I recall right? So without DBX, you should disable kvstore on HF too.

r. Ismo

Re: Where can I disable kvstore?

mikefg — Fri, 22 Sep 2023 14:43:40 GMT

Maybe not a common TA or app, but Splunk App for Stream uses kvstore. Found this out recently doing some troubleshooting. So on stream servers make sure in server.conf to set

[kvstore]
disabled = false

Re: Where can I disable kvstore?

mikefg — Mon, 25 Sep 2023 14:34:23 GMT

Found another app that needs kvstore, but this one is a vendor TA. kvstore was not referenced in any documentation and I only found out after I stopped getting data. Fixed now, just keep an eye out for missing data after disabling kvstore on a HF.