topic Re: KVStorageProvider max_size_per_result_mb limit in Monitoring Splunk

KVStorageProvider max_size_per_result_mb limit

whitefang1726 — Tue, 20 May 2025 07:52:32 GMT

Hello Splunkers,

Good Day! I'm getting this error consistent. Out of confusion, those this mean it's the estimated KVStore size? max_size_per_result_mb value is current set by default (50 MB).

KVStorageProvider [123456789 TcpChannelThread] - Result size too large, max_size_per_result_mb=52428800, Consider applying a skip and/or limit

Thanks!

Re: KVStorageProvider max_size_per_result_mb limit

kiran_panchavat — Tue, 20 May 2025 08:09:55 GMT

@whitefang1726

In the Splunk KV store, max_size_per_result_mb controls the maximum size of a result set (in MB) that can be returned from a single query to a collection.

Default Value:

The default value is 50 MB, but it's recommended to increase it if you need to retrieve larger results from the KV store

https://docs.splunk.com/Documentation/Splunk/latest/admin/Limitsconf

max_size_per_result_mb = <unsigned integer>
* The maximum size, in megabytes (MB), of the result that will be
  returned for a single query to a collection.
* Default: 50

Re: KVStorageProvider max_size_per_result_mb limit

kiran_panchavat — Tue, 20 May 2025 08:12:32 GMT

@whitefang1726

The error does not indicate the total size of the KV Store. Instead, it means the data returned by a specific query is too large (exceeds 50 MB). Your query is likely retrieving too many records or large documents from the KV Store, exceeding the 50 MB limit per result set.