Splunk Dev

delete some records from kvstore not working

sarit_s
Communicator

Hello
im trying to delete some records from my kvstore collection

when running this command (there are more keys i just didnt wanted it to be long) :

| inputlookup kv_alerts_prod 
| where ( ( _key="5f401a77cc0ddc039e76ade4" ) OR ( _key="5f401a77cc0ddc039e76ade5" ) OR ( _key="5f401a78cc0ddc039e76ade6" ) OR ( _key="5f401a78cc0ddc039e76ade7" ) OR ( _key="5f401a7bcc0ddc039e76ade8" ) OR ( _key="5f401a81cc0ddc039e76ade9" ) OR ( _key="5f401a84cc0ddc039e76adea" ) OR ( _key="5f401a84cc0ddc039e76adeb" ) OR ( _key="5f401a84cc0ddc039e76adec" ) OR ( _key="5f401a84cc0ddc039e76aded" ) OR ( _key="5f401a84cc0ddc039e76adee" ) OR ( _key="5f401a84cc0ddc039e76adef" ) OR ( _key="5f401a84cc0ddc039e76adf0" ) OR ( _key="5f401a84cc0ddc039e76adf1" ) OR ( _key="5f401a85cc0ddc039e76adf2" ) 
| outputlookup kv_alerts_prod

  im getting this error :

KV Store output failed with err: Request exceeds API limits - see limits.conf for details. (Batch save size=105742989 too large)

 

my limits.conf file looks like this :

[kvstore]
max_size_per_result_mb = 100000
max_size_per_batch_result_mb = 1000000000
max_size_per_batch_save_mb = 10000000000

 

what can i do ?

Labels (1)
0 Karma

Nisha18789
Builder

Hi @sarit_s , the key for the limit you are seeing is max_queries_per_batch , can you add this key in the kvstore stanza with a value greater than the value for which you are seeing the error and see it that fixes?

0 Karma

sarit_s
Communicator

Hello
thanks for your answer

 i added this and still getting the same error

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...