Can you help me with my KVstore replication to indexers?

[nawazns5038]

Hi,

We have a KVstore being replicated to the indexers.

After replication to the indexers where is the data stored in the indexers?

What does path /opt/splunk/var/lib/splunk/kvstore/ mean in the indexers ?

We have changed...

SPLUNK_DB=/local/hot/ and there are two KVstore folders one in /local/hot and other in /opt/splunk/var/lib/splunk/kvstore/ ??

Is it safe to delete /opt/splunk/var/lib/splunk/kvstore/ ?

Thanks

[gjanders]

As per How to replicate a Search Head Cluster's KV Store lookup data to an Indexer? the answer explains the kvstore is replicated via CSV files included in the bundle, there are also some conf presentations covering this topic but I don't have them handy

There is no kvstore to kvstore sync, so the kvstore on the indexers does not relate to that on the search heads, therefore it does not matter where you kvstore is located on the indexing tier, the search tier doesn't mind...