Splunk Enterprise

Need help help reg. KVSTORE running on the Search Heads? Do you agree that kvstores should only run on the SHs? Thx

SamHTexas
Builder

I work in a large Splunk, ES clustered environment. Should the KVSTORES only be running on the SHs? Looks like after upg. to 8.2.4, we have to use WiredTiger kvstore. Do you have any input on what tier should the kvstores need to be running on? Any input on using WiredTiger kvstore please. I appreciate your response in advance.

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I agree that KVStore need only run on search heads.

I switched my sandbox to WiredTiger when it first became available and haven't looked back since.  Then again, I don't do much with KVStore.  You should performance improvements, however.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...