Splunk Enterprise

How to solve problem with kv store after upgrading to Splunk enterprise version9?

benedict
Observer

I recently upgraded our splunk enterprise to version9.0.1 but I do have problems with the kvstore. Any ideas on how to deal with this please?

Labels (3)
0 Karma

benedict
Observer

Hi @chaker,

Firstly I did an upgrade from version 8.2 to 9.0.1 in a non-prod environment which I had to migrate the kvstore storage to wiredTiger. Now the plan was to push this upgrade to my prod environment but since the prod environment still has the old DB (kv-store), it could overwrite the data and could lead to data loss in the prod environment. so this is my major problem. 

0 Karma

chaker
Contributor

Hi @benedict 

Follow this document to backup the KVStore.

https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/BackupKVstore

Here is the upgrade document for KV store for V8.0. Change version to match your exact point release.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

what you are meaning with “push to production”?

The normal way is just upgrade first mongodb to WiredTiger and after that to do a splunk upgrade to 9.0.1. That will convert data to the newer version and not overwrite it.

r. Ismo

0 Karma

chaker
Contributor

Hi @benedict 

Can you describe the exact problem you are having? V9 does make some upgrades to the KV Store, you may need to upgrade the storage engine to "WiredTiger"

https://docs.splunk.com/Documentation/Splunk/9.0.1/ReleaseNotes/MeetSplunk

To take advantage of the most up-to-date KV Store in this latest release, Splunk Enterprise 9.0 comes with a set of tools to guide the upgrade of your KV store server version to v4.2, as well as the migration of your KV Store storage engine. These updates are required in Splunk Enterprise 9.0. See Migrate the KV store storage engine in the Admin manual to plan your migration.

http://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/MigrateKVstore

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...