Splunk Dev

delete some records from kvstore not working

sarit_s
Communicator

Hello
im trying to delete some records from my kvstore collection

when running this command (there are more keys i just didnt wanted it to be long) :

| inputlookup kv_alerts_prod 
| where ( ( _key="5f401a77cc0ddc039e76ade4" ) OR ( _key="5f401a77cc0ddc039e76ade5" ) OR ( _key="5f401a78cc0ddc039e76ade6" ) OR ( _key="5f401a78cc0ddc039e76ade7" ) OR ( _key="5f401a7bcc0ddc039e76ade8" ) OR ( _key="5f401a81cc0ddc039e76ade9" ) OR ( _key="5f401a84cc0ddc039e76adea" ) OR ( _key="5f401a84cc0ddc039e76adeb" ) OR ( _key="5f401a84cc0ddc039e76adec" ) OR ( _key="5f401a84cc0ddc039e76aded" ) OR ( _key="5f401a84cc0ddc039e76adee" ) OR ( _key="5f401a84cc0ddc039e76adef" ) OR ( _key="5f401a84cc0ddc039e76adf0" ) OR ( _key="5f401a84cc0ddc039e76adf1" ) OR ( _key="5f401a85cc0ddc039e76adf2" ) 
| outputlookup kv_alerts_prod

  im getting this error :

KV Store output failed with err: Request exceeds API limits - see limits.conf for details. (Batch save size=105742989 too large)

 

my limits.conf file looks like this :

[kvstore]
max_size_per_result_mb = 100000
max_size_per_batch_result_mb = 1000000000
max_size_per_batch_save_mb = 10000000000

 

what can i do ?

Labels (1)
0 Karma

Nisha18789
Builder

Hi @sarit_s , the key for the limit you are seeing is max_queries_per_batch , can you add this key in the kvstore stanza with a value greater than the value for which you are seeing the error and see it that fixes?

0 Karma

sarit_s
Communicator

Hello
thanks for your answer

 i added this and still getting the same error

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...