When enabling the MC to run in distributed mode, these are the steps that need to be followed: Configure the Search Head as a Deployment Server search peer Configure the Cluster Manager as a Deployment Server search peer Configure the Deployment Server a cluster search and with search affinity disabled ./splunk edit cluster-config -mode searchhead -manager_uri https://<manager-uri-ip>:8089 -secret <secret> Restart the deployment server Once the Cluster Manager is added as a Deployment Server search peer, the indexers automatically appear as remote instances on the Monitoring Console ... View more

Also got the same issue during a Splunk upgrade, did a restart of the Splunk service and the KV store was fixed ... View more

You also need to give permission to the splunk user to write to the volumes you are writing to on the indexer, i.e. if you have a /hot and /cold volume on the indexer, the splunk user needs to have ownership and permissions to write to these volumes. ... View more

Has the bug been resolved in Splunk Enterprise version 9.2.1 (latest version)? ... View more