Deployment Architecture

Splunk KV Store setup in a Search head Cluster

ephremzw
Loves-to-Learn Everything

Hi,

 

I having an issue with setting up my search head cluster environment. I have a stand alone deployment server instance, a SHC deployer, and 3 search heads. Do I need KV Store setup in all of the instances or is it only in the SHC deployer or Deployment server?

 

Thank you,

0 Karma

VatsalJagani
Champion

You need to set up KVstore in all the search heads part of SHC, that in terms of creating a cluster of KVstore.

When you follow the guide of SHC deployment it will automatically do KVstore cluster creation. - https://docs.splunk.com/Documentation/Splunk/8.2.6/DistSearch/SHCdeploymentoverview 

 

0 Karma

ephremzw
Loves-to-Learn Everything

ok, I understand regarding the SHC KV Store. So does the SH Deployer and Deployment Server require KV Store?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

I think that those can work without it, unless you're a running there some apps which are needing that?

Usually there are kvstore on all SH nodes, but as I said probably it's not needed unless you have separate apps which are using it.

0 Karma

VatsalJagani
Champion

@ephremzw 

When you installed normal Splunk installation KVstore will be enabled by default. If you are not using it you can disable it.

I generally keep it running on any Splunk instance even though I'm not using it as far as it's not harming any policies.

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

SHC cluster or actually it's members share same kvstore which are replicated over those members. Deployer has it's own private version. Also DS can have it's own. You don't need/should use DS with SHC! All apps must deployed via Deployer Server (which is different component than DS) to SHC members.

As @VatsalJagani said SHC's kvstore is initialised when you are bootstrapping SHC. See more from those documents.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...