Deployment Architecture

Effects of a kvstore resync on a search head cluster

Explorer

Hello everyone,

I have a kvstore down on a 4 member search head cluster.

I'd like to resync it without impacting too much the users activity.

I've got 2 options :

- put the instance in detention, stop it, clean the store, start it and put it out of detention

=> but I'm not sure how the new requests will be handled from the load balancer in front of the cluster...

- log in to the kvstore captain, and resync all => does that action launch a rolling restart ? does it affect the performance ? I couldn't find info on that.

I used mostly : https://docs.splunk.com/Documentation/Splunk/latest/Admin/ResyncKVstore

Thanks in advance,

Ema

Labels (3)
Tags (2)
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!