Where can I disable kvstore?

[mikefg]

Running 9.0.x now, and I'm getting messages about kvstore issues on indexers, etc. I understand I can disable kvstore on some systems, but not all.

Where do I need it upgraded to wiredTiger and where can I disable it?

Search heads - enabled and upgraded to wiredTiger
Enterprise security search head - enabled and upgraded to wiredTiger
Cluster master - mmapv1
Indexers - mmapv1
Deployment server - mmapv1
Heavy forwarders - enabled and upgraded to wiredTiger

[gcusello]

Hi @mikefg 

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[gcusello]

Hi @mikefg ,

as @richgalloway said, it's a best practice to disable KV-Store in all Splunk servers except Search Heads to use the resources for other purposes,

even if, there are some Add-Ons, that must be installed on HFs or IDXs, that disabling KV-Store will give you error messages because they use KV-Store .

Anyway, you can disable KV-Store adding to server.conf the following stanza:

[kvstore]
disabled = true

Ciao.

Giuseppe

[isoutamo]

Hi

I don’t remember any other commonly used TA on HFs than the newest DB Connect which are requiring kvstore. Unfortunately that is not clearly said on documentation if I recall right? So without DBX, you should disable kvstore on HF too.

r. Ismo

[mikefg]

Maybe not a common TA or app, but Splunk App for Stream uses kvstore. Found this out recently doing some troubleshooting. So on stream servers make sure in server.conf to set

[kvstore]
disabled = false

[richgalloway · Accepted solution]

I would enable KVStore on search heads and disable it everywhere else.  HFs are not search heads and don't need KVStore unless you have an app that specifically calls for it.

[mikefg]

Found another app that needs kvstore, but this one is a vendor TA. kvstore was not referenced in any documentation and I only found out after I stopped getting data. Fixed now, just keep an eye out for missing data after disabling kvstore on a HF.