Getting Data In

How do you configure remote KV store on Universal Forwarder?

envancleve
Engager

I have an application which uses the KV store to store the application's state. When installing it on a universal forwarder, I get errors saying "HTTP 503 Service Unavailable -- KV Store status is unknown"

I understand that there is no support for local KV stores on universal forwarders. However, is there any mechanism available which allows us to force queries to a remote KV store?

I tried editing the server.conf file with the following, but it didn't appear to have any effect:

[kvstore]
replication_host =

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's no way to do that. The performance of the kvstore comes from it being a local, in-memory data store. Reaching across the network to another server would kill the performance.

If you really need a kvstore, use a heavy forwarder instead of a universal forwarder.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...