Splunk Enterprise

Why are removed search heads still showing in the "splunk show kvstore-status" command?

briancronrath
Contributor

I have old searchheads that were removed via "splunk remove shcluster-member" command.  They rightfully do not show when I run "splunk show shcluster-status", however when I run  "splunk show kvstore-status" all the removed searchheads still show in this listing.  How do I get them removed from the kvstore clustering as well?

Labels (1)
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@briancronrath Hello Brian, The instance is automatically deleted from the KV store when it is removed from the search head cluster. The instance shouldn't be included in the KV store  outcomes. If it does show up, your search head cluster may not be functioning properly.

Remove a cluster member - Splunk Documentation 

KV store troubleshooting tools - Splunk Documentation

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...