I saw the message below on a cluster master used in a multisite environment. Search peer s1-indexer04 has the following message: KV Store changed status to failed. KVStore process terminated The following steps worked for me: Stop splunk indexer Sample command: /opt/splunk/bin/splunk stop remove the mongod.lock file Sample command: sudo rm -rf /data1/kvstore/mongo/mongod.lock Starting Splunk Sample command: /opt/splunk/bin/splunk start
... View more