Splunk Enterprise

Why are removed search heads still showing in the "splunk show kvstore-status" command?

briancronrath
Contributor

I have old searchheads that were removed via "splunk remove shcluster-member" command.  They rightfully do not show when I run "splunk show shcluster-status", however when I run  "splunk show kvstore-status" all the removed searchheads still show in this listing.  How do I get them removed from the kvstore clustering as well?

Labels (1)
0 Karma

kiran_panchavat
Contributor

@briancronrath Hello Brian, The instance is automatically deleted from the KV store when it is removed from the search head cluster. The instance shouldn't be included in the KV store  outcomes. If it does show up, your search head cluster may not be functioning properly.

Remove a cluster member - Splunk Documentation 

KV store troubleshooting tools - Splunk Documentation

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...