Splunk Enterprise

Need help help reg. KVSTORE running on the Search Heads? Do you agree that kvstores should only run on the SHs? Thx

SamHTexas
Builder

I work in a large Splunk, ES clustered environment. Should the KVSTORES only be running on the SHs? Looks like after upg. to 8.2.4, we have to use WiredTiger kvstore. Do you have any input on what tier should the kvstores need to be running on? Any input on using WiredTiger kvstore please. I appreciate your response in advance.

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I agree that KVStore need only run on search heads.

I switched my sandbox to WiredTiger when it first became available and haven't looked back since.  Then again, I don't do much with KVStore.  You should performance improvements, however.

---
If this reply helps you, Karma would be appreciated.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...