Disable kvstore replication to indexers

[Lucas_K]

According to this post kvstores get replicated to indexers.

Is there a way to disable or specifically control this behaviour.

We have a kvstore > 100GB that doesn't need to be replicated. And I believe this may be causing performance issues.

[lcrielaa]

Can't you simply disable the KVStore on the indexers via server.conf?

[kvstore]
disabled = true|false
* Set to true to disable the KV Store process on the current server. To
  completely disable KV Store in a deployment with search head clustering or
  search head pooling, you must also disable KV Store on each individual
  server.
* Defaults to false.

[TStrauch]

Hi Lucas,

no worry. Your kvstore is not automatically replicated to your indexer.

You have a parameter in collections.conf called "replicate" its false by default. By switching it to "true" your kvstore collection gets replicated to the indexers.

So no worry about your 100GB + kvstore.

regards

[Lucas_K]

Ahh so that post is actually wrong! Thanks!

[s2_splunk]

Fair enough. My response you refer to could have been a bit more nuanced.
Pre 6.3, there was no capability to replicate KV-Store based lookups to the search peers, which prevented you from using those lookups in searches, because they would not have been available to the indexers similar to what search bundle replication does.
This limitation was removed in 6.3, i.e. we provided the controls to replicate those lookups that are needed by search peers to fulfill search requests.
Yes, you can disable that for lookups you only need to have available on the search heads.
Sorry for any confusion this may have caused you.