Had this issue in a pretty large cluster (over 40 Splunk servers). KVStore Upgrade would not work on ANY host. After lots of fiddling and trying to find a cause and solution, we had to give up. At least we found a reliable and easy enough workaround. Sharing it here in case someone else stumbles on this. This workaround is tested with v8.1.9, so should definitely work with versions above as well. splunk backup kvstore ls /opt/splunk/var/lib/kvstorebackup (tgz-Namen notieren) Edit /opt/splunk/etc/system/local/server.conf, add: [kvstore] storageEngine=wiredTiger systemctl shutdown Splunkd rm -r /opt/splunk/var/lib/kvstore systemctl start Splunkd splunk restore kvstore -archiveName <tgz-Name> Hope it helps some of you.
... View more