Deployment Architecture

Effects of a kvstore resync on a search head cluster

emallinger
Communicator

Hello everyone,

I have a kvstore down on a 4 member search head cluster.

I'd like to resync it without impacting too much the users activity.

I've got 2 options :

- put the instance in detention, stop it, clean the store, start it and put it out of detention

=> but I'm not sure how the new requests will be handled from the load balancer in front of the cluster...

- log in to the kvstore captain, and resync all => does that action launch a rolling restart ? does it affect the performance ? I couldn't find info on that.

I used mostly : https://docs.splunk.com/Documentation/Splunk/latest/Admin/ResyncKVstore

Thanks in advance,

Ema

Labels (3)
Tags (2)
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...