Monitoring Splunk

monitoring KV store status of heavy forwarders

Strangertinz
Path Finder

Hi All, 

What are some of the best ways to monitor the health status of KV store of the heavy forwarders in my environment. I am looking for a way to monitor it with a search from my search head. 

 

 

Thanks in advance! 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

+1 On the "forget the KVstore" part. Unless you have one of those strange inputs which insist on keeping state in kvstore, just disable the kvstore altogether and don't worry about it.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

why you want keep kvstore running on your HFs? Usually it’s not needed there! Only reason why you need it, is some modular input which keep its checkpoint there. Usually this means that you have wrote it by yourself.

If you really need it, then add HF as indexer on your MC and use it for monitoring.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...