Can any one tell me, What is KV store ? How does it useful in cluster environment ?
Through the docs, I am not getting clear understanding!
Hi @vsskishore,
As shown here : http://dev.splunk.com/view/webframework-developapps/SP-CAAAEY7
The App Key Value Store (or simply, KV Store) feature of Splunk Enterprise provides a way to save and retrieve data within your Splunk apps, thereby enabling you to manage and maintain the state of the application.
In short it's a mongodb based data store that you can use to store data and use later on for lookup, for saving states of apps or even for defining workflows and saving the logic.
In a clustered environment this DB is shared and synchronized between all your SH cluster members. A great for a kv-store beginner to use it to replace your large lookupfiles with kv-store lookups, this will greatly improve the lookup performance 🙂
Let me know if you need more details I can give you some more links to documentations and further explanation.
Cheers,
David