Deployment Architecture

Can we enable shared KV store with Search Head Pooling (not clustering)?

philip_wong
Communicator

We're not ready to apply Search Head Clustering yet, but we're on Search Head Pooling now. Can we apply KV store quickly without waiting for SHC?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

KV Store can be utilized on SHP - HOWEVER - replication does NOT happen, as the Search heads are unaware of each other. In fact, KVStore is a 6.2 feature, and 6.2 deprecates SHP. So IMHO, I would suggest to start fresh with a SHC and then use KVStore. It will make your life way easier.

philip_wong
Communicator

The description from server.conf seems telling me it's possible on SHP.
I'm not sure what should be here. FQDN? Or should match with general/serverName in server.conf

replication_host = <host>
    * In search head pooling, this host value is a requirement for using KV Store. 
    * This is the address on which a kvstore will be available for accepting
      remotely.
0 Karma

dmr195
Communicator

Check out dgladkikh's answer here: http://answers.splunk.com/answers/231043/how-to-configure-and-distribute-kvstore-in-a-splun.html#ans...

The replication_host needs to be set to a name that can be resolved by your DNS from the other members of the replica set.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...