Getting Data In

How to find KVStore status in internal logs

santosh_hb
Explorer

Hi all,

I have got a task where I have to find the KVStore status through Splunk internal logs. I neither have access to Monitoring Console nor I can run the CLI commands. I have only access to Splunk internal logs. Could you please help me with this? thanks, Santosh

Tags (1)
0 Karma

santosh_hb
Explorer

Hi Rich, Thanks for sharing the details. My issue is: I want to fetch the KVStore running status (Success/Failure/...) from multiple hosts.
I need something like below:

Hostname KVStore status

host1 running
host2 failed

thanks,
Santosh

0 Karma

gjanders
SplunkTrust
SplunkTrust

In Alerts for SplunkAdmins , or github I have:
AllSplunkEnterpriseLevel - KVStore Process Terminated
SearchHeadLevel - Detect MongoDB errors

And/or potentially SearchHeadLevel - KVStore Or Conf Replication Issues Are Occurring

They might provide detection of when it is crashing, the mongodb checks the logs are still updating which is a sign of it running...

0 Karma

Richfez
SplunkTrust
SplunkTrust

I guess it depends on what you mean by "status".

index=_internal kvstore

Will get you something - metrics, which might tell you enough, and other things too.

I expect you will like this next thing better, though - there's a whole REST thing you can do, if you have those rights. Give it a try and see...

like

| rest /servicesNS/nobody/MYAPP/storage/collections/config

will show you all the configured collections in app MYAPP, and

| rest /servicesNS/nobody/MYAPP/storage/collections/data/COLLECTIONNAME

Will show you the data, which you could always | stats count or something.

You can use some of the stuff from the REST API docs to do this, but know that you can't edit anything from | rest in Splunk, because security. (Which I'm not sure makes sense since curl can, with the right password? What? Anyway, no worries on that).

Anwyay, those examples can be modified like my examples to do things.

If that's what you needed, great. If it isn't, well, tell us more specifically exactly what it is you need - WHAT status are you looking for? - and maybe we can help!

-Rich

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...