Splunk Enterprise

Need help help reg. KVSTORE running on the Search Heads? Do you agree that kvstores should only run on the SHs? Thx


I work in a large Splunk, ES clustered environment. Should the KVSTORES only be running on the SHs? Looks like after upg. to 8.2.4, we have to use WiredTiger kvstore. Do you have any input on what tier should the kvstores need to be running on? Any input on using WiredTiger kvstore please. I appreciate your response in advance.

Labels (1)
Tags (1)
0 Karma


I agree that KVStore need only run on search heads.

I switched my sandbox to WiredTiger when it first became available and haven't looked back since.  Then again, I don't do much with KVStore.  You should performance improvements, however.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...