Which command should be run to re-sync a stale KV Store member in a search head cluster?

Question

Options

• Asplunk clean kvstore -local
• Bsplunk resync kvstore -remote
• Csplunk resync kvstore -local
• Dsplunk clean eventdata -local

• A
  89% (41)
• B
  7% (3)
• C
  2% (1)
• D
  2% (1)

Explanation

To resync a stale KV Store member in a search head cluster, you need to stop the search head that has the stale KV Store member, run the command splunk clean kvstore --local, and then restart the search head. This triggers the initial synchronization from other KV Store members12. The command splunk resync kvstore [-source sourceId] is used to resync the entire KV Store cluster from one of the members, not a single member. This command can only be invoked from the node that is operating as search head cluster captain2. The command splunk clean eventdata -local is used to delete all indexed data from a standalone indexer or a cluster peer node, not to resync the KV Store3. 1: How to resolve error on a search head member in the search head cluster ... 2: Resync the KV store - Splunk Documentation 3: Delete indexed data - Splunk Documentation

No community discussion yet for this question.