Relocate KVstore in a cluster

[nawazns5038]

Hi,

How do we relocate the KVstore on to a new location in a search head cluster.

I heard that there are some settings on the server.conf which would help in relocating the KVstore but what is the safest way to do it in a cluster without causing any KV store errors ??

Thanks

[dchoi_splunk]

Tested on SHC which has 3 members:
To change the default kvstore path to a different mount point in SHC, below steps can be doable.

1. Stop the service on one of search head member(not kvstore primary)
2. Repoint the kvstore path to a newly created empty directory with write permission (http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf?utm_source=answers&utm_medium=in...)
3. Start the service
4. Check if resync is working.
5. then repeat 1-4 for the next member

Above steps worked.

[solarboyz1]

You will need to do it one member at a time.

Take the member out of the cluster.
shut member down
Follow instructions to move kvstore
Start member
Add member to cluster

Repeat on next cluster member.

[solarboyz1]

I don't believe so, the cluster will not recognize changes made by edits to the ../etc/system/local/server.conf.

If you're concerned...then you could shut the entire cluster down and move the location. Just requires and outage.

[nawazns5038]

If we do that won't there be any errors if the member joins back with a different KV store location than others ? ?

[p_gurav]

This may help:
https://answers.splunk.com/answers/389298/relocate-kvstore-files-on-filesystem.html

[nawazns5038]

yup, but how do you do it in a cluster without any errors ??