I work in a large Splunk, ES clustered environment. Should the KVSTORES only be running on the SHs? Looks like after upg. to 8.2.4, we have to use WiredTiger kvstore. Do you have any input on what tier should the kvstores need to be running on? Any input on using WiredTiger kvstore please. I appreciate your response in advance.
I agree that KVStore need only run on search heads.
I switched my sandbox to WiredTiger when it first became available and haven't looked back since. Then again, I don't do much with KVStore. You should performance improvements, however.