How to use KV Store in a search head cluster?

[ehudb]

Hello
I have a search head cluster with 3 peers.
Now I want to use KV Store within that cluster, with |inputlookup`|lookup` commands.
What is the correct way to do that?

When I created manually KV Store on one of the search heads, it didn't replicate to the other peers, so I cannot run lookup queries from the other search heads.

As I understood from the docs, it shouldn't replicate through SHC, but there should be a way to 'remotely' query the KV Store.

[Masa]

"""When I created manually KV Store on one of the search heads, it didn't replicate to the other peers"""
=> In SHC, any manual (editing configuration file) won't be replicated. So, you're right. Not replicated.

. """ As I understood from the docs, it shouldn't replicate through SHC,"""
=> Docs making you believe KVStore is not replicated in SHC is not great. Can put a link so that doc team can improve the page?

Once SHC is enabled, KVstore data will be automatically replicated to SHC members. So, even if one SH node is down, other SH nodes will keep the same data available.

I recommend to visit the following links, and try to create a custom app and add collections.conf for KVStore settings and transforms.conf for lookups. Try it in a standalone instance to make sure it works. Then, you can deploy the custom app from Deployer to SHC.

http://dev.splunk.com/view/SP-CAAAEY7

http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/ConfigureKVstorelookups