KVStore Fails to Start After Splunk Enterprise 9.4 Upgrade Due to Certificate Chain Mismatch

Available Languages

Updated:October 1, 2026
Document ID:SPLK053716

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise 9.4 and higher on Windows platforms.

Description

Following an upgrade to Splunk Enterprise 9.4, the KVStore service reports a "failed" status and remains unreachable on port 8191. Log analysis indicates SSL peer certificate validation failure (errorCode: 800B0109) and file access errors (WiredTiger error 13).


Investigation

1.. Review mongod.log and splunkd.log for SSL handshake failures and WiredTiger permission errors.
2.. Verify CPU support for AVX/AVX2 instructions using the Coreinfo tool.
3.. Check for stale lock files (WiredTiger.lock, mongod.lock) in the KVStore data directory.
4.. Confirm effective NTFS permissions on the path:

 G:\splunk\kvstore\

5.. Inspect SplkCert.pem for extra certificate chain data; only the server certificate and private key should be present.


Resolution

Modify the SplkCert.pem file to contain strictly the server certificate and the private key. Remove all intermediate and root CA certificate entries. Restart the Splunk service to allow the KVStore to transition to a "Ready" state. Apply McAfee/Trellix exclusions to the Splunk directory and mongod.exe to prevent file-level access interference.


KVStore Fails to Start After Upgrading to Splunk Enterprise 9.4.x

Troubleshoot KV Store

Migrate the KV Store

System Requirements for Splunk Enterprise

Revision History

Revision Publish Date Comments
1.0
01-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products