Splunk Enterprise

KVstore folders in /opt/splunk/var/lib/splunk/kvstorebackup/

Path Finder

Hi splunk community,

So on one of the search heads my SHC environment's /opt/splunk/var/lib/splunk/kvstorebackup/ directory, besides the kvdump.tar.gz, there seems to be multiple folders of tmpKVRestore_*

Those folders seem to contain the apps and the .json data.

I would like to ask if those folders are safe to be removed, and if those folders are caused by restoring splunk kvstore on the search head, which splunk did not remove it as a means of housekeeping after the successful restore?


Labels (2)
Tags (1)
0 Karma


hi @d_lim,
Splunk does not remove backup archived files in /opt/splunk/var/lib/splunk/kvstorebackup/ even after restoring them.
Check if the data exists in kvdump.tar.gz (you can untar it) and tmpKVRestore_* directory is there in KVStore collections. You can use lookups if look up definitions configured for these collections or below rest API endpoint. If yes then you can delete these directories and the tar file.


If this reply helps you, a like would be appreciated.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!