About the app key value store

The app key value store (or KV store) provides a way to save and retrieve data within your Splunk apps, thereby letting you manage and maintain the state of the application.

Here are some ways that Splunk apps might use the KV Store:

  • Tracking workflow in an incident-review system that moves an issue from one user to another.
  • Keeping a list of environment assets provided by users.
  • Controlling a job queue.
  • Managing a UI session by storing the user or application state as the user interacts with the app.
  • Storing user metadata.
  • Caching results from search queries by Splunk or an external data store.
  • Storing checkpoint data for modular inputs.

For information on using the KV store, including how it compares to lookups, see app key value store documentation for Splunk app developers.

How KV store works with your deployment

The KV store stores your data as key-value pairs in collections. Here are the main concepts:

  • Collections are the containers for your data, similar to a database table. Collections exist within the context of a given app.
  • Records contain each entry of your data, similar to a row in a database table.
  • Fields correspond to key names, similar to the columns in a database table. Fields contain the values of your data as a JSON file. Although it is not required, you can enforce data types (number, boolean, time, and string) for field values.
  • _key is a reserved field that contains the unique ID for each record. If you don't explicitly specify the _key value, the app auto-generates one.
  • _user is a reserved field that contains the user ID for each record. This field cannot be overridden.
  • Accelerations improve search performance by making searches that contain accelerated fields return faster. Accelerations store a small portion of the collection's data set in an easy-to-traverse form.

The KV store files reside on search heads.

In a search head cluster, if any node receives a write, the KV store delegates the write to the KV store captain. The KV store keeps the reads local, however.

System requirements

KV store is available and supported on all Splunk Enterprise 64-bit builds. It is not available on 32-bit Splunk Enterprise builds. KV store is also not available on universal forwarders. See the Splunk Enterprise system requirements.

KV store uses port 8191 by default. See "System requirements and other deployment considerations for search head clusters" in the Distributed Search Manual.

Determine whether your apps use KV store

KV store is enabled by default on Splunk Enterprise 6.2+.

Apps that use the KV store typically have collections.conf defined in $SPLUNK_HOME/etc/apps/<app name>/default. In addition, transforms.conf will have references to the collections with external_type = kvstore

Use the KV store

To use the KV store:

1. Create a collection and optionally define a list of fields with data types using configuration files or the REST API.

2. Perform create-read-update-delete (CRUD) operations using search lookup commands and the Splunk REST API.

3. Manage collections using the REST API.

Monitor its effect on your Splunk Enterprise deployment

You can monitor your KV store performance through two views in the distributed management console. One view provides insight across your entire deployment (see "KV store: Deployment" in this manual). The other view gives you information about KV store operations on each search head (see "KV store: Instance").

Back up KV store data

Back up and restore your KV store data using the standard backup and restore tools and procedures used by your organization. To back up KV store data, back up all files in the path that is specified in the dbPath parameter of the [kvstore] stanza in the server.conf file.

For general information about backup strategies in Splunk Enterprise, see "Choose your backup strategy" in the Managing Indexers and Clusters of Indexers manual.

splunk中mongodb作用——存用户相关数据如会话、搜索结果等的更多相关文章

  1. [渣译文] 使用 MVC 5 的 EF6 Code First 入门 系列:为ASP.NET MVC应用程序读取相关数据

    这是微软官方教程Getting Started with Entity Framework 6 Code First using MVC 5 系列的翻译,这里是第七篇:为ASP.NET MVC应用程序 ...

  2. 为ASP.NET MVC应用程序读取相关数据

    为ASP.NET MVC应用程序读取相关数据 2014-05-08 18:24 by Bce, 299 阅读, 0 评论, 收藏, 编辑 这是微软官方教程Getting Started with En ...

  3. C#开发微信门户及应用(14)-在微信菜单中采用重定向获取用户数据

    我曾经在系列文章中的<C#开发微信门户及应用(11)--微信菜单的多种表现方式介绍>中介绍了微信菜单里面的重定向操作,通过这个重定向操作,我们可以获取一个code值,然后获取用户的open ...

  4. EntityFramework_MVC4中EF5 新手入门教程之五 ---5.通过 Entity Framework 读取相关数据

    在前面的教程中,您完成School数据模型.在本教程中,您会读取和显示相关的数据 — — 那就是,实体框架将加载到导航属性的数据. 下面的插图显示页面,您将完成的工作. 延迟. 预先,和显式加载的相关 ...

  5. WCF技术剖析之十五:数据契约代理(DataContractSurrogate)在序列化中的作用

    原文:WCF技术剖析之十五:数据契约代理(DataContractSurrogate)在序列化中的作用 [爱心链接:拯救一个25岁身患急性白血病的女孩[内有苏州电视台经济频道<天天山海经> ...

  6. 伪基站,卒于5G——本质上是基于网络和UE辅助的伪基站检测,就是将相邻基站的CI、信号强度等信息通过测量报告上报给网络,网络结合网络拓扑、配置信息等相关数据,对所有数据进行综合分析,确认在某个区域中是否存在伪基站

    伪基站,卒于5G from:https://www.huxiu.com/article/251252.html?h_s=h8 2018-07-05 21:58收藏27评论6社交通讯     本文来自微 ...

  7. vue中前进刷新、后退缓存用户浏览数据和浏览位置的实践

    vue中前进刷新.后退缓存用户浏览数据和浏览位置的实践 2018年07月07日 11:58:40 大灰狼的小绵羊哥哥 阅读数:4492   vue中,我们所要实现的一个场景就是: 1.搜索页面==&g ...

  8. 在Asp.NET Core中如何优雅的管理用户机密数据

    在Asp.NET Core中如何优雅的管理用户机密数据 背景 回顾 在软件开发过程中,使用配置文件来管理某些对应用程序运行中需要使用的参数是常见的作法.在早期VB/VB.NET时代,经常使用.ini文 ...

  9. 在mysql数据库中创建oracle scott用户的四个表及插入初始化数据

    在mysql数据库中创建oracle scott用户的四个表及插入初始化数据 /* 功能:创建 scott 数据库中的 dept 表 */ create table dept( deptno int ...

随机推荐

  1. MySQL 字符串拼接

    MySQL 字符串拼接 在Mysql 数据库中存在两种字符串连接操作.具体操作如下 1. CONCAT(string1,string2,…)   说明 : string1,string2代表字符串,c ...

  2. CSS 基础知识点 样式 选择器 伪类

    CSS 基础知识点汇集 版权声明:这篇博客是别人写的,大神博客地址 : https://www.cnblogs.com/Mtime/p/5184685.html 1.CSS 简介 CSS 指层叠样式表 ...

  3. 01: JavaScript实例

    1.1 基础 JavaScript 实例 <body> <script type="text/javascript"> document.write(&qu ...

  4. 骁龙820和KryoCPU:异构计算与定制计算的作用 【转】

    本文转载自:https://www.douban.com/group/topic/89037625/ Qualcomm骁龙820处理器专为提供创新用户体验的顶级移动终端而设计.为实现消费者所期望的创新 ...

  5. 客户端向服务端请求连接是出现"ssh : Connection refused"原因有哪些

    注意:服务端的sshd服务已经正常开启 (可以正常进行连接) 1.在服务端负载比较高的情况下客户端请求连接时会出现连接被拒绝的情况

  6. CF620E New Year Tree 线段树 dfs序

    luogu链接 题目大意: 有一个节点有颜色的树 操作1.修改子树的颜色 操作2.查询子树颜色的种类 注意,颜色种类小于60种 只有子树的操作,dfs序当然是最好的选择 dfs序列是什么,懒得讲了,自 ...

  7. [BZOJ1776][Usaco2010 Hol]cowpol 奶牛政坛

    Description 农夫约翰的奶牛住在N (2 <= N <= 200,000)片不同的草地上,标号为1到N.恰好有N-1条单位长度的双向道路,用各种各样的方法连接这些草地.而且从每片 ...

  8. Ubuntu 14.04 删除软件附加依赖

    参考:FlowVisor的学习笔记 eg.mininet $ sudo apt-get remove mininet $ sudo apt-get remove --auto-remove minin ...

  9. spring boot打war包发布

    由于公司一贯的方式都是将war包布在中间件tomcat下运行 所以这次springboot项目需要打war包 how to? 第一步:pom.xml 文件中,打包方式需要修改成war <pack ...

  10. 小行星碰撞 Asteroid Collision

    2018-08-07 11:12:01 问题描述: 问题求解: 使用一个链表模拟栈,最后的状态一定是左侧全部是负值,表示的是向左飞行,右侧的全部是正值,表示的是向右飞行. 遍历整个数组,对于每个读到的 ...