Hi All, I am currently performing upgrade of my entire Splunk cluster environment.
While performing the Search Head upgrade, do I really need to take KVStore backup?
My understanding is: All the data including kvstore data will be stored on Indexers and while doing the upgrade of Indexers we can take the backup of KVStore.
If in case, KVStore backup is required on Search Head, what is the purpose of it as I understand that Search Head doesn't have any important KVStore data that needs to be backedup.
I see that there are multiple apps within the Search Head that are running and few apps might use these KVStore data. But, isn't the actual storage of KVStore data happens on Indexers?
