Knowledge Management

When using splunk backup kvstore command, is the completion status logged, specifically in the case of an error/failure?

andysm
Engager

I'm looking to capture any failures of a kvstore backup that is kicked off from a script.

Tags (1)

codebuilder
SplunkTrust
SplunkTrust

There are several ways that you can tackle this.

Capture output from the Splunk command:

./splunk show kvstore-status

Use the REST API:

curl -k -u user:pass https://<host>:<mPort>/services/kvstore/status
curl -k -u user:pass https://<host>:<mPort>/services/messages

Errors and warnings are logged to both splunkd.log and mongod.log

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

pedromunoz
Engager

I had the same question.
We found the following event in the internal logs of the Search Head were the kvstore backup was run:

127.0.0.1 - admin [03/Feb/2020:17:15:44.925 -0500] "POST /services/kvstore/backup/create HTTP/1.1" 200 1747 - - - 0ms

Otherwise we have yet to determine a reliable way to identify the status of a kvstore backup job from internal/introspection logs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...