Skip to content

splunk get-kvstore-status

Access KV store status information for standalone or search head clustering (SHC) deployments.

Description

Access KV store status information for standalone or search head clustering (SHC) deployments. For SHC deployments, provides information on SHC members where KV Store is enabled and used for replication.

Synopsis

splunk get-kvstore-status
    --site <site>
    [--count <count>]
    [--sort_key <sort_key>]
    [--sort_dir <sort_dir>]

Arguments

site - (string)

     Site where this command will be executed
     Example: --site "site-1"
     Default: input.site      Attributes: required

count - (int)

     Limit the number of results returned. Set 0 to return all results.
     Example: --count 0
     Default: 0      Attributes: optional

sort_key - (string)

     Field name to use for sorting.
     Example: --sort_key "updated"
     Default: updated      Attributes: optional

sort_dir - (string)

     Response sort order.
     Example: --sort_dir "sort_dir-1"
     Default: _None_      Attributes: optional

     Validation:
         allowed values: asc, desc

Examples

Input: 

!splunk get-kvstore-status
Output: 
UPDATED                     AUTHOR  NAME   
1970-01-01T05:30:00+05:30   system  status
Input: 
x= !splunk get-kvstore-status
Output: 
{
   "links": {},
   "origin": "https://localhost:8089/servicesNS/admin/-/kvstore/status",
   "updated": "2023-02-07T15:30:02+05:30",
   "generator": {
     "build": "dd0128b1f8cd",
     "version": "9.0.3"
   },
   "entry": [
     {
       "name": "status",
       "id": "https://localhost:8089/servicesNS/admin/-/kvstore/status/status",
       "updated": "1970-01-01T05:30:00+05:30",
       "links": {
         "alternate": "/servicesNS/admin/-/kvstore/status/status",
         "list": "/servicesNS/admin/-/kvstore/status/status"
       },
       "author": "system",
       "acl": {
         "app": "",
         "can_list": true,
         "can_write": true,
         "modifiable": false,
         "owner": "system",
         "perms": {
           "read": [
             "admin",
             "splunk-system-role"
           ],
           "write": [
             "admin",
             "splunk-system-role"
           ]
         },
         "removable": false,
         "sharing": "system"
       },
       "content": {
         "current": {
           "backupRestoreStatus": "Ready",
           "date": 0,
           "dateSec": 1675764002.176,
           "disabled": false,
           "guid": "E2343068-DB25-47B3-AECC-3FEDF7C8E7F1",
           "oplogEndTimestamp": 0,
           "oplogEndTimestampSec": 1675764002,
           "oplogStartTimestamp": 0,
           "oplogStartTimestampSec": 1672901557,
           "port": 8191,
           "replicaSet": "E2343068-DB25-47B3-AECC-3FEDF7C8E7F1",
           "replicationStatus": "KV store captain",
           "standalone": true,
           "status": "ready",
           "storageEngine": "wiredTiger"
         },
         "eai:acl": null,
         "members": {
           "0": {
             "configVersion": 1,
             "electionDate": 0,
             "electionDateSec": 1675761777,
             "hostAndPort": "127.0.0.1:8191",
             "lastHeartbeat": null,
             "lastHeartbeatRecv": null,
             "lastHeartbeatRecvSec": null,
             "lastHeartbeatSec": null,
             "optimeDate": 0,
             "optimeDateSec": 1675764002,
             "pingMs": null,
             "replicationStatus": "KV store captain",
             "uptime": 2226
           }
         }
       }
     }
   ],
   "paging": {
     "total": 1,
     "perPage": 30,
     "offset": 0
   },
   "messages": []
 }

Access Control

To use this command, you need access to the following:

Field Value
Action "read"
Service Type "splunk"
Service Instance
Namespace
Object Type "kvstore"
Object ID

Please see Access Control for details.