Splunk Enterprise

Why are removed search heads still showing in the "splunk show kvstore-status" command?

briancronrath
Contributor

I have old searchheads that were removed via "splunk remove shcluster-member" command.  They rightfully do not show when I run "splunk show shcluster-status", however when I run  "splunk show kvstore-status" all the removed searchheads still show in this listing.  How do I get them removed from the kvstore clustering as well?

Labels (1)
0 Karma

kiran_panchavat
Contributor

@briancronrath Hello Brian, The instance is automatically deleted from the KV store when it is removed from the search head cluster. The instance shouldn't be included in the KV store  outcomes. If it does show up, your search head cluster may not be functioning properly.

Remove a cluster member - Splunk Documentation 

KV store troubleshooting tools - Splunk Documentation

0 Karma
Get Updates on the Splunk Community!

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...