https://community.splunk.com/t5/Alerting/KVstore/m-p/681313#M15834 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/264928">@whitecat001</a>&nbsp;<BR /><BR />The best starting point is to view the KV store events from the Monitoring console. Then look for events that correspond to any issues and build alerts based on it.<BR /><BR />Below is a sample query you can use to view health status of KV Stores. Alert on health_info -&gt; red</P><LI-CODE lang="markup">|rest /services/server/info |eval a=now() |eval time=strftime(a,"%Y-%m-%d %H:%M:%S") |table time host kvStoreStatus author health_info isForwarding server_roles |sort host</LI-CODE><P><BR />&nbsp;If the reply helps, a karma upvote would be appreciated.</P> Wed, 20 Mar 2024 05:36:22 GMT Gr0und_Z3r0 2024-03-20T05:36:22Z https://community.splunk.com/t5/Alerting/KVstore/m-p/681235#M15829 <P>1. Pls whats the best way to monitor kvstore?</P><P>2. What is the best way to monitor errors from kvstore migration&nbsp;</P> Tue, 19 Mar 2024 19:09:39 GMT https://community.splunk.com/t5/Alerting/KVstore/m-p/681235#M15829 whitecat001 2024-03-19T19:09:39Z https://community.splunk.com/t5/Alerting/KVstore/m-p/681313#M15834 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/264928">@whitecat001</a>&nbsp;<BR /><BR />The best starting point is to view the KV store events from the Monitoring console. Then look for events that correspond to any issues and build alerts based on it.<BR /><BR />Below is a sample query you can use to view health status of KV Stores. Alert on health_info -&gt; red</P><LI-CODE lang="markup">|rest /services/server/info |eval a=now() |eval time=strftime(a,"%Y-%m-%d %H:%M:%S") |table time host kvStoreStatus author health_info isForwarding server_roles |sort host</LI-CODE><P><BR />&nbsp;If the reply helps, a karma upvote would be appreciated.</P> Wed, 20 Mar 2024 05:36:22 GMT https://community.splunk.com/t5/Alerting/KVstore/m-p/681313#M15834 Gr0und_Z3r0 2024-03-20T05:36:22Z https://community.splunk.com/t5/Alerting/KVstore/m-p/681356#M15836 <P>Thanks for the reply but will prefer checking through the cli, maybe like a command to achieve that&nbsp;</P> Wed, 20 Mar 2024 10:57:29 GMT https://community.splunk.com/t5/Alerting/KVstore/m-p/681356#M15836 whitecat001 2024-03-20T10:57:29Z https://community.splunk.com/t5/Alerting/KVstore/m-p/681363#M15837 <P>Then you should check this troubleshooting guide...<BR /><A href="https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/TroubleshootKVstore" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/TroubleshootKVstore</A></P> Wed, 20 Mar 2024 11:41:19 GMT https://community.splunk.com/t5/Alerting/KVstore/m-p/681363#M15837 Gr0und_Z3r0 2024-03-20T11:41:19Z