Splunk KV store Issue

[sivakrishna]

Hi Team,

We have 4 Search heads are in cluster in that one Search head is getting the KV store PORT issue asking that change the port remaining 3 SHs working fine. We are unable to restart the Splunk on that particular SH. If i check the SH cluster status only 3 servers are showing now.

Splunk installed version: 9.0.4.1

for error visibility Please find the attached. 

Regards,

Siva.

[SanjayReddy]

Hi @sivakrishna 

it seems KVstrore port 8191 is used by other application.

can you check which process using 8191 port ,

ps -ef | grep -i 8191 

if is used by other application check with os team to check and ask them use other port, 

then you can start splunk and kvstore will start on port 8191

[sivakrishna]

Thanks for the reply!!

can we change the port for this server??

What will happen if i change the PORT for this single server when it's in the cluster?

Remaining 3 servers are running on the 8191 PORT.

[SanjayReddy]

Hi @sivakrishna 

instaed of changing rhe port, if 8191 is already used by splunk then please kill  and start the splunk

have you checked which process using 8191 ,

if you wan the change the port , you need to change port on rest search heads, which is not recomended 

[sivakrishna]

Still getting the same PORT issue @SanjayReddy 

[sivakrishna]

Hi @SanjayReddy 

If i execute the above process check command getting the below.