Deployment Architecture

Splunk KV Store setup in a Search head Cluster

ephremzw
Loves-to-Learn Everything

Hi,

 

I having an issue with setting up my search head cluster environment. I have a stand alone deployment server instance, a SHC deployer, and 3 search heads. Do I need KV Store setup in all of the instances or is it only in the SHC deployer or Deployment server?

 

Thank you,

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

You need to set up KVstore in all the search heads part of SHC, that in terms of creating a cluster of KVstore.

When you follow the guide of SHC deployment it will automatically do KVstore cluster creation. - https://docs.splunk.com/Documentation/Splunk/8.2.6/DistSearch/SHCdeploymentoverview 

 

0 Karma

ephremzw
Loves-to-Learn Everything

ok, I understand regarding the SHC KV Store. So does the SH Deployer and Deployment Server require KV Store?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

I think that those can work without it, unless you're a running there some apps which are needing that?

Usually there are kvstore on all SH nodes, but as I said probably it's not needed unless you have separate apps which are using it.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@ephremzw 

When you installed normal Splunk installation KVstore will be enabled by default. If you are not using it you can disable it.

I generally keep it running on any Splunk instance even though I'm not using it as far as it's not harming any policies.

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

SHC cluster or actually it's members share same kvstore which are replicated over those members. Deployer has it's own private version. Also DS can have it's own. You don't need/should use DS with SHC! All apps must deployed via Deployer Server (which is different component than DS) to SHC members.

As @VatsalJagani said SHC's kvstore is initialised when you are bootstrapping SHC. See more from those documents.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...