Splunk KV Store setup in a Search head Cluster

[ephremzw]

Hi,

I having an issue with setting up my search head cluster environment. I have a stand alone deployment server instance, a SHC deployer, and 3 search heads. Do I need KV Store setup in all of the instances or is it only in the SHC deployer or Deployment server?

Thank you,

[VatsalJagani]

You need to set up KVstore in all the search heads part of SHC, that in terms of creating a cluster of KVstore.

When you follow the guide of SHC deployment it will automatically do KVstore cluster creation. - https://docs.splunk.com/Documentation/Splunk/8.2.6/DistSearch/SHCdeploymentoverview 

[ephremzw]

ok, I understand regarding the SHC KV Store. So does the SH Deployer and Deployment Server require KV Store?

[isoutamo]

I think that those can work without it, unless you're a running there some apps which are needing that?

Usually there are kvstore on all SH nodes, but as I said probably it's not needed unless you have separate apps which are using it.

[VatsalJagani]

@ephremzw 

When you installed normal Splunk installation KVstore will be enabled by default. If you are not using it you can disable it.

I generally keep it running on any Splunk instance even though I'm not using it as far as it's not harming any policies.

[isoutamo]

Hi

SHC cluster or actually it's members share same kvstore which are replicated over those members. Deployer has it's own private version. Also DS can have it's own. You don't need/should use DS with SHC! All apps must deployed via Deployer Server (which is different component than DS) to SHC members.

As @VatsalJagani said SHC's kvstore is initialised when you are bootstrapping SHC. See more from those documents.

r. Ismo