What is the impact on kvsore data the clean kvstore or move mongo

[WorapongJ]

I’m trying to understand Splunk KV Store to determine what happens when it fails to start or shows a "failure to restore" status. I’ve found two possible solutions, but I'm not sure whether either command will delete all data in the KV Store?

Solution1:
- ./splunk stop
- mv $SPLUNK_HOME/var/lib/splunk/kvstore/mongo /path/to/copy/kvstore/mongo_old
-./splunk start

Solution2:

- ./splunk stop
- ./splunk clean kvstore --local
-./splunk start

[livehybrid]

Hi @WorapongJ 

Both of these will result in an empty KV Store, although with the first you will have a copy of it to wherever you moved it to.

What is it you are trying to achieve here?

For KV Store troubleshooting check out https://docs.splunk.com/Documentation/Splunk/latest/Admin/TroubleshootKVstore

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[WorapongJ]

What is it you are trying to achieve here?

I would just like to know the impact in case I encounter a KV Store status failure. How can I identify which apps, such as ES, might be affected If I remove or clear kvstore data?

[VatsalJagani · Accepted solution]

@WorapongJ- Yes in both case you will loose data.

And I know you are trying to understand the impact of it on Splunk. But there is usually a recovery option available for KVstore/Mongo depending on what has happened or what's the issue.

I hope this helps!!!