@JRW You solution worked for me like charm. I spend more than 6 hours troubleshooting until i stumble on yours and decided to try it out even though its not marked as the preferred solution. Thank you ... View more

@sylim_splunk  After apply STEP 9 (Changing the Replication Factor back to what it was), the KV store went back to STARTING. Every other step worked to get the KV store to ready but it went back to starting after changing the replication factor back to 3 which was the original. is there any splunk solution for this KVstore issue? It is very painful not to find a workaround about this kvstore issue ... View more

I spent 3 days trying to fix this issue as Jenkins was not publishing its build analysis to Splunk. This solution worked for me and thanks to @dvargas_splunk. On Jenkins -> Manage Jenkins -> Scroll down to the Splunk connection entries -> Advanced -> Event Source: source="*" I restarted Jenkins and Splunk service and I started seeing the Jenkins Build Analysis in Splunk ... View more

After applying the changes from Step 9-12. stopping splunk service,changing the replication factor back to what it was and starting all SH members. The KVstore status goes back to starting.  The KVstore status was initially in Ready mode after applying step 1-8. Is there any reason why this is happening. ... View more

Thanks for the explanation. However, I will like to know if it is ideal for the Heavy Forwarder to be forwarding to the Indexer Master? I understand that the Indexer master is not part of the Indexer cluster and it only control the activities on the IDX cluster, but i am just just curious how do it do that. My question: 1. Can the HF ----- IDX MASTER ? Can the HF forward data to the IDX Master too? 2. Can the Indexer Master be added to the RECIEVING PEERS like the Indexers? 3. If we have 2 HF and we want to forwarder data from UF to the HF, do we have to run the command to forward logs to the HF:9997 twice to achieve that? 4. Is there any way to cluster Heavy Forwarder in SplunK Please advice ... View more